{"qid": 0, "source": "http://purl.org/co/size", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RXQ_OVFL", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_after", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti#id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 1, "source": "https://ontology.unifiedcyberontology.org/uco/identity/Identity", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_header_hashes", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_KEEPALIVE", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 2, "source": "https://ontology.unifiedcyberontology.org/uco/identity/Identity", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_header_hashes", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_KEEPALIVE", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 3, "source": "https://ontology.unifiedcyberontology.org/uco/observable/addressOfEntryPoint", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_code", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BROADCAST", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#loader_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_handle", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_descriptor", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 4, "source": "https://ontology.unifiedcyberontology.org/uco/observable/baseOfCode", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/infrastructure#infrastructure_types", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti#first_seen", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_code", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix/adversary#threat_actor_types", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_privileged", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti/stix/ext/process#aslr_enabled", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 5, "source": "https://ontology.unifiedcyberontology.org/uco/observable/bitsPerPixel", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/user-account#can_escalate_privs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/file#name_enc", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti#latitude", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFlags", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/file#size", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 6, "source": "https://ontology.unifiedcyberontology.org/uco/observable/domain", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti#region", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DOMAIN", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs_id", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti#version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 7, "source": "https://ontology.unifiedcyberontology.org/uco/observable/dstPackets", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti#latitude", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/malware#architecture_execution_envs", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_packets", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_port", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 8, "source": "https://ontology.unifiedcyberontology.org/uco/observable/entropy", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFillAttribute", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 9, "source": "https://ontology.unifiedcyberontology.org/uco/observable/fileAlignment", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_handle", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BUSY_POLL", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#section_alignment", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#protocols", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/identity#sectors", "http://docs.oasis-open.org/ns/cti#latitude", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 10, "source": "https://ontology.unifiedcyberontology.org/uco/observable/gid", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#groups", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_code", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_phases", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti#lang", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/file#name_enc", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#name_constraints", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 11, "source": "https://ontology.unifiedcyberontology.org/uco/observable/imageBase", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BROADCAST", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 12, "source": "https://ontology.unifiedcyberontology.org/uco/observable/majorImageVersion", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BINDTODEVICE", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#win32_version_value_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti#spec_version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 13, "source": "https://ontology.unifiedcyberontology.org/uco/observable/majorLinkerVersion", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti#first_seen", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BSDCOMPAT", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#win32_version_value_hex", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 14, "source": "https://ontology.unifiedcyberontology.org/uco/observable/majorSubsystemVersion", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BSDCOMPAT", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#win32_version_value_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#loader_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "http://docs.oasis-open.org/ns/cti#spec_version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 15, "source": "https://ontology.unifiedcyberontology.org/uco/observable/minorImageVersion", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/adversary#goals", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix#sample_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 16, "source": "https://ontology.unifiedcyberontology.org/uco/observable/minorLinkerVersion", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/adversary#primary_motivation", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 17, "source": "https://ontology.unifiedcyberontology.org/uco/observable/minorSubsystemVersion", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/identity#sectors", "http://docs.oasis-open.org/ns/cti#submitted", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_handle", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix/software#swid", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BSDCOMPAT", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix/adversary#goals", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 18, "source": "https://ontology.unifiedcyberontology.org/uco/observable/number", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/software#swid", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#content_disposition", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti#lang", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 19, "source": "https://ontology.unifiedcyberontology.org/uco/observable/numberOfSections", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_code", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 20, "source": "https://ontology.unifiedcyberontology.org/uco/observable/numberOfSubkeys", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_code", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/ext/process#windows_title", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_privileged", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/adversary#threat_actor_types", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs_id", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 21, "source": "https://ontology.unifiedcyberontology.org/uco/observable/numberOfSymbols", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_phases", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti#languages", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti#lang", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix#sample_ref", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti#object_type", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 22, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sectionAlignment", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti#first_seen", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs_id", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_OOBINLINE", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_code", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFillAttribute", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#section_alignment", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 23, "source": "https://ontology.unifiedcyberontology.org/uco/observable/size", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/adversary#goals", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 24, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sizeOfCode", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_code", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSCRED", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdError", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BSDCOMPAT", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#is_optimized", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BUSY_POLL", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 25, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sizeOfHeaders", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#basic_constraints", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/adversary#secondary_motivations", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_NAPI_ID", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#name_constraints", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 26, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sizeOfHeapCommit", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/user-account#can_escalate_privs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/message#content_disposition", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SELECT_ERR_QUEUE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUFFORCE", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVTIMEO", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti#aliases", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 27, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sizeOfHeapReserve", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/user-account#can_escalate_privs", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/adversary#goals", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/message#content_disposition", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_FILTER", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti#first_seen", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_CBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/process#aslr_enabled", "http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 28, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sizeOfImage", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_service_account", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#section_alignment", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdOutput", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BUSY_POLL", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/user-account#can_escalate_privs", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix#sample_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#is_optimized", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUFFORCE", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 29, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sizeOfInitializedData", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#ipfix", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_OOBINLINE", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix#Campaign", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_code", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 30, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sizeOfOptionalHeader", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_descriptor", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BINDTODEVICE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_first_login", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#crl_distribution_points", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFlags", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 31, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sizeOfStackCommit", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_CBPF", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#aslr_enabled", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#can_escalate_privs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVTIMEO", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/infrastructure#infrastructure_types", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 32, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sizeOfStackReserve", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DOMAIN", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVTIMEO", "http://docs.oasis-open.org/ns/cti/stix/user-account#can_escalate_privs", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix#Vulnerability", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 33, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sizeOfUninitializedData", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_code", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti#submitted", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 34, "source": "https://ontology.unifiedcyberontology.org/uco/observable/srcPackets", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_descriptor", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_packets", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#protocols", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_port", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#loader_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_OOBINLINE", "http://docs.oasis-open.org/ns/cti/stix/infrastructure#infrastructure_types", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 35, "source": "https://ontology.unifiedcyberontology.org/uco/observable/subjectPublicKeyExponent", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/directory#path_enc", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti#SHA3-256_hash_value", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#protocols", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 36, "source": "https://ontology.unifiedcyberontology.org/uco/types/hashValue", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti#SHA3-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs_id", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 37, "source": "https://ontology.unifiedcyberontology.org/uco/action/object", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti#created", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 38, "source": "https://ontology.unifiedcyberontology.org/uco/analysis/classificationConfidence", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti#first_seen", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#can_escalate_privs", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_listening", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref_id", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUFFORCE", "http://docs.oasis-open.org/ns/cti#confidence", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#section_alignment", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/message#content_disposition", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs_id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 39, "source": "https://ontology.unifiedcyberontology.org/uco/configuration/itemDescription", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/identity#sectors", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#home_dir", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 40, "source": "https://ontology.unifiedcyberontology.org/uco/observable/peType", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_code", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdOutput", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 41, "source": "https://ontology.unifiedcyberontology.org/uco/core/specVersion", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BSDCOMPAT", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/software#swid", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_OOBINLINE", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 42, "source": "https://ontology.unifiedcyberontology.org/uco/action/startTime", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVTIMEO", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#section_alignment", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_last_login", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/process#created_time", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 43, "source": "https://ontology.unifiedcyberontology.org/uco/observable/EmailMessage", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix/location#building_details", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFlags", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 44, "source": "https://ontology.unifiedcyberontology.org/uco/marking/definitionType", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/adversary#sophistication", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti#languages", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BSDCOMPAT", "http://docs.oasis-open.org/ns/cti#country", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 45, "source": "https://ontology.unifiedcyberontology.org/uco/observable/comment", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti#submitted", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/message#recevied_lines", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs_id", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti#revoked", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdOutput", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_descriptor", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 46, "source": "https://ontology.unifiedcyberontology.org/uco/observable/basicConstraints", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#protocols", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#name_constraints", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_after", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_OOBINLINE", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#basic_constraints", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix/adversary#primary_motivation", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 47, "source": "https://ontology.unifiedcyberontology.org/uco/observable/serviceType", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_descriptor", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti/stix/infrastructure#infrastructure_types", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_port", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix#Sighting", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#loader_flags_hex", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 48, "source": "https://ontology.unifiedcyberontology.org/uco/observable/windowTitle", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#name_constraints", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#home_dir", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_header_hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ERROR", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFlags", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_OOBINLINE", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_phases", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFillAttribute", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/process#windows_title", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix/file#name_enc", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 49, "source": "https://ontology.unifiedcyberontology.org/uco/observable/contentType", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dep_enabled", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 50, "source": "https://ontology.unifiedcyberontology.org/uco/observable/environmentVariables", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/infrastructure#infrastructure_types", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BINDTODEVICE", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 51, "source": "https://ontology.unifiedcyberontology.org/uco/observable/Process", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#home_dir", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti#extension_properties", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "http://docs.oasis-open.org/ns/cti/stix#KillChainPhase", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti#spec_version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 52, "source": "https://ontology.unifiedcyberontology.org/uco/observable/serialNumber", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/message#from_ref_id", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFillAttribute", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RXQ_OVFL", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 53, "source": "https://ontology.unifiedcyberontology.org/uco/observable/accountLogin", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_NAPI_ID", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_service_account", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BINDTODEVICE", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_login", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_first_login", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSCRED", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#is_active", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ERROR", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_privileged", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_last_login", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 54, "source": "https://ontology.unifiedcyberontology.org/uco/marking/GranularMarking", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_phases", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 55, "source": "https://ontology.unifiedcyberontology.org/uco/observable/validityNotBefore", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdError", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#loader_flags_hex", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_after", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/infrastructure#infrastructure_types", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 56, "source": "https://ontology.unifiedcyberontology.org/uco/observable/startupInfo", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix#sample_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti#region", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 57, "source": "https://ontology.unifiedcyberontology.org/uco/marking/statement", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti#revoked", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/adversary#goals", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#groups", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti#submitted", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#basic_constraints", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 58, "source": "https://ontology.unifiedcyberontology.org/uco/observable/mimeType", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSCRED", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RXQ_OVFL", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PROTOCOL", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix#Process", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 59, "source": "https://ontology.unifiedcyberontology.org/uco/observable/PDFFile", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEEK_OFF", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Country", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 60, "source": "https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_packets", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#win32_version_value_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#ipfix", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_KEEPALIVE", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti#longitude", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 61, "source": "https://ontology.unifiedcyberontology.org/uco/observable/Mutex", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/process#created_time", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SELECT_ERR_QUEUE", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 62, "source": "https://ontology.unifiedcyberontology.org/uco/observable/language", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#protocols", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti#languages", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti#lang", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/adversary#sophistication", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 63, "source": "https://ontology.unifiedcyberontology.org/uco/core/startTime", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/message#recevied_lines", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_last_login", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs", "http://docs.oasis-open.org/ns/cti/stix#Malware", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/process#created_time", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVTIMEO", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#groups", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti/stix/adversary#secondary_motivations", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 64, "source": "https://ontology.unifiedcyberontology.org/uco/core/Relationship", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix#KillChainPhase", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 65, "source": "https://ontology.unifiedcyberontology.org/uco/observable/inhibitAnyPolicy", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_first_login", "http://docs.oasis-open.org/ns/cti/stix/infrastructure#infrastructure_types", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix/identity#sectors", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#loader_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#is_optimized", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BUSY_POLL", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEADDR", "http://docs.oasis-open.org/ns/cti/stix/ext/process#aslr_enabled", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_KEEPALIVE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_BPF", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BROADCAST", "http://docs.oasis-open.org/ns/cti/data-marking#selectors", "http://docs.oasis-open.org/ns/cti/stix/location#building_details", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_listening", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dep_enabled", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_CBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 66, "source": "https://ontology.unifiedcyberontology.org/uco/location/postalCode", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/user-account#can_escalate_privs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 67, "source": "https://ontology.unifiedcyberontology.org/uco/observable/labels", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/process#created_time", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BINDTODEVICE", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 68, "source": "https://ontology.unifiedcyberontology.org/uco/tool/version", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/adversary#secondary_motivations", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 69, "source": "https://ontology.unifiedcyberontology.org/uco/tool/version", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/adversary#secondary_motivations", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 70, "source": "https://ontology.unifiedcyberontology.org/uco/tool/version", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/adversary#secondary_motivations", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 71, "source": "https://ontology.unifiedcyberontology.org/uco/location/Location", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RXQ_OVFL", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti#revoked", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix#NetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti#languages", "http://docs.oasis-open.org/ns/cti/stix/directory#path_enc", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_privileged", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 72, "source": "https://ontology.unifiedcyberontology.org/uco/location/region", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/location#building_details", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#region", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/file#name_enc", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti#latitude", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix/identity#sectors", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 73, "source": "https://ontology.unifiedcyberontology.org/uco/observable/requestMethod", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/directory#path_enc", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix/adversary#secondary_motivations", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DOMAIN", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ACCEPTCONN", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 74, "source": "https://ontology.unifiedcyberontology.org/uco/core/context", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix#CourseOfAction", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdOutput", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti#abstract", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 75, "source": "https://ontology.unifiedcyberontology.org/uco/observable/serviceName", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_NAPI_ID", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/data-marking#selectors", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti#languages", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#win32_version_value_hex", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_service_account", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 76, "source": "https://ontology.unifiedcyberontology.org/uco/observable/isHidden", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix#Sighting", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#is_active", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFlags", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti#first_seen", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#windows_title", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFillAttribute", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 77, "source": "https://ontology.unifiedcyberontology.org/uco/observable/icmpCode", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_packets", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_port", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix/software#swid", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEADDR", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RXQ_OVFL", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_NAPI_ID", "http://docs.oasis-open.org/ns/cti/stix#Incident", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 78, "source": "https://ontology.unifiedcyberontology.org/uco/observable/WindowsPEBinaryFile", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti#extension_properties", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/location#building_details", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 79, "source": "https://ontology.unifiedcyberontology.org/uco/observable/isSelfSigned", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref_id", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 80, "source": "https://ontology.unifiedcyberontology.org/uco/observable/File", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_packets", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix#Vulnerability", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSSEC", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BINDTODEVICE", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 81, "source": "https://ontology.unifiedcyberontology.org/uco/observable/descriptions", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/identity#sectors", "http://docs.oasis-open.org/ns/cti/stix/location#building_details", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti#languages", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti#extension_types", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 82, "source": "https://ontology.unifiedcyberontology.org/uco/observable/body", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#Vulnerability", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti#extension_properties", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_CBPF", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_first_login", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/location#building_details", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 83, "source": "https://ontology.unifiedcyberontology.org/uco/observable/policyMappings", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#loader_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#crl_distribution_points", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/infrastructure#infrastructure_types", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_FILTER", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti#extension_properties", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 84, "source": "https://ontology.unifiedcyberontology.org/uco/identity/Organization", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix#CourseOfAction", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/adversary#sophistication", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/adversary#goals", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 85, "source": "https://ontology.unifiedcyberontology.org/uco/observable/priority", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix#Malware", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERCRED", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 86, "source": "https://ontology.unifiedcyberontology.org/uco/observable/priority", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix#Malware", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERCRED", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 87, "source": "https://ontology.unifiedcyberontology.org/uco/observable/certificatePolicies", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#basic_constraints", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#crl_distribution_points", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DOMAIN", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix#Vulnerability", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSSEC", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERCRED", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BINDTODEVICE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PROTOCOL", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti#region", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 88, "source": "https://ontology.unifiedcyberontology.org/uco/observable/pointerToSymbolTable", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PROTOCOL", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs_id", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFillAttribute", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 89, "source": "https://ontology.unifiedcyberontology.org/uco/observable/nameConstraints", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#basic_constraints", "http://docs.oasis-open.org/ns/cti#SHA3-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFlags", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/file#name_enc", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#name_constraints", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs_id", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/identity#sectors", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref_id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 90, "source": "https://ontology.unifiedcyberontology.org/uco/observable/keyUsage", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSCRED", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_listening", "http://docs.oasis-open.org/ns/cti#submitted", "http://docs.oasis-open.org/ns/cti/stix/adversary#threat_actor_types", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#loader_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_service_account", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_KEEPALIVE", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/adversary#personal_motivations", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 91, "source": "https://ontology.unifiedcyberontology.org/uco/observable/Software", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/network-traffic#ipfix", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#groups", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix#Malware", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix#Tool", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 92, "source": "https://ontology.unifiedcyberontology.org/uco/observable/issuer", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/infrastructure#infrastructure_types", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 93, "source": "https://ontology.unifiedcyberontology.org/uco/observable/dataType", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdOutput", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RXQ_OVFL", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BINDTODEVICE", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_handle", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 94, "source": "https://ontology.unifiedcyberontology.org/uco/observable/depEnabled", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/malware#is_family", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BSDCOMPAT", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#aslr_enabled", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/file#name_enc", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti#extension_properties", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_CBPF", "http://docs.oasis-open.org/ns/cti/stix/malware#architecture_execution_envs", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dep_enabled", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 95, "source": "https://ontology.unifiedcyberontology.org/uco/observable/hashes", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_header_hashes", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RXQ_OVFL", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix#sample_ref", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti#hashes", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 96, "source": "https://ontology.unifiedcyberontology.org/uco/observable/issuerAlternativeName", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_FILTER", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 97, "source": "https://ontology.unifiedcyberontology.org/uco/observable/NTFSFile", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/location#building_details", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#home_dir", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix#Software", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 98, "source": "https://ontology.unifiedcyberontology.org/uco/observable/key", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix#sample_ref", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/adversary#secondary_motivations", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERCRED", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 99, "source": "https://ontology.unifiedcyberontology.org/uco/core/externalReference", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_NAPI_ID", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SELECT_ERR_QUEUE", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#name_constraints", "http://docs.oasis-open.org/ns/cti#extension_properties", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 100, "source": "https://ontology.unifiedcyberontology.org/uco/observable/authorityKeyIdentifier", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdError", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/data-marking#selectors", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_service_account", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref", "http://docs.oasis-open.org/ns/cti/stix/file#name_enc", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 101, "source": "https://ontology.unifiedcyberontology.org/uco/location/latitude", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_packets", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti#latitude", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti#region", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_first_login", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti#precision", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 102, "source": "https://ontology.unifiedcyberontology.org/uco/observable/WindowsRegistryValue", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFlags", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 103, "source": "https://ontology.unifiedcyberontology.org/uco/observable/isDisabled", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#revoked", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#is_active", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_after", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFlags", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 104, "source": "https://ontology.unifiedcyberontology.org/uco/observable/requestValue", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#section_alignment", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ERROR", "http://docs.oasis-open.org/ns/cti/stix#Malware", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 105, "source": "https://ontology.unifiedcyberontology.org/uco/observable/groupName", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#groups", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#home_dir", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti#lang", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 106, "source": "https://ontology.unifiedcyberontology.org/uco/observable/displayName", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#windows_title", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 107, "source": "https://ontology.unifiedcyberontology.org/uco/observable/displayName", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#windows_title", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 108, "source": "https://ontology.unifiedcyberontology.org/uco/observable/displayName", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#windows_title", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 109, "source": "https://ontology.unifiedcyberontology.org/uco/marking/StatementMarking", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#loader_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#home_dir", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix#KillChainPhase", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix#Vulnerability", "http://docs.oasis-open.org/ns/cti#Hashes", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 110, "source": "https://ontology.unifiedcyberontology.org/uco/observable/AlternateDataStream", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti#region", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_byte_count", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti#lang", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 111, "source": "https://ontology.unifiedcyberontology.org/uco/observable/extendedKeyUsage", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ERROR", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RXQ_OVFL", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_KEEPALIVE", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_privileged", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdError", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEADDR", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BUSY_POLL", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 112, "source": "https://ontology.unifiedcyberontology.org/uco/observable/pdfId0", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix#Malware", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#NetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/adversary#threat_actor_types", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/malware#architecture_execution_envs", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix#CourseOfAction", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERCRED", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 113, "source": "https://ontology.unifiedcyberontology.org/uco/marking/MarkingDefinition", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEEK_OFF", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti/stix#KillChainPhase", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti#revoked", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti#analysis_ended", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 114, "source": "https://ontology.unifiedcyberontology.org/uco/observable/subjectDirectoryAttributes", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/adversary#personal_motivations", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_descriptor", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti/stix/software#swid", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 115, "source": "https://ontology.unifiedcyberontology.org/uco/observable/messageID", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/directory#path_enc", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ERROR", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 116, "source": "https://ontology.unifiedcyberontology.org/uco/location/country", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti#region", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs_id", "http://docs.oasis-open.org/ns/cti#url", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 117, "source": "https://ontology.unifiedcyberontology.org/uco/observable/timeDateStamp", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti#first_seen", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/process#created_time", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti#revoked", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 118, "source": "https://ontology.unifiedcyberontology.org/uco/observable/isActive", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_port", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti#revoked", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#is_optimized", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_last_login", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix#CourseOfAction", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#is_active", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 119, "source": "https://ontology.unifiedcyberontology.org/uco/action/objective", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "http://docs.oasis-open.org/ns/cti#confidence", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#is_optimized", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti/stix/adversary#sophistication", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DOMAIN", "http://docs.oasis-open.org/ns/cti/stix/adversary#goals", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix#Sighting", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_code", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 120, "source": "https://ontology.unifiedcyberontology.org/uco/observable/requestVersion", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_handle", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 121, "source": "https://ontology.unifiedcyberontology.org/uco/observable/fileHeaderHashes", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BINDTODEVICE", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix#sample_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix#NetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_NAPI_ID", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_header_hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_KEEPALIVE", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 122, "source": "https://ontology.unifiedcyberontology.org/uco/observable/swid", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti#extension_properties", "http://docs.oasis-open.org/ns/cti#first_seen", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix/software#swid", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERCRED", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#aslr_enabled", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 123, "source": "https://ontology.unifiedcyberontology.org/uco/observable/aslrEnabled", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BROADCAST", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSCRED", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_BPF", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_service_account", "http://docs.oasis-open.org/ns/cti/stix/adversary#goals", "http://docs.oasis-open.org/ns/cti/stix/ext/process#aslr_enabled", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_after", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SELECT_ERR_QUEUE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_listening", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dep_enabled", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#crl_distribution_points", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_KEEPALIVE", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_CBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BINDTODEVICE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BUSY_POLL", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_directory_attributes", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 124, "source": "https://ontology.unifiedcyberontology.org/uco/observable/isMultipart", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dep_enabled", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_NAPI_ID", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti/stix/directory#path_enc", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_privileged", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 125, "source": "https://ontology.unifiedcyberontology.org/uco/observable/DomainName", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdOutput", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_port", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#Campaign", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Directory", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 126, "source": "https://ontology.unifiedcyberontology.org/uco/core/confidence", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix#sample_ref", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti#confidence", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti/stix/adversary#secondary_motivations", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#is_optimized", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_byte_count", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/adversary#goals", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 127, "source": "https://ontology.unifiedcyberontology.org/uco/observable/X509V3ExtensionsFacet", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_NAPI_ID", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/adversary#secondary_motivations", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSSEC", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 128, "source": "https://ontology.unifiedcyberontology.org/uco/core/modifiedTime", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix/process#created_time", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/adversary#sophistication", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_last_login", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs_id", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_OOBINLINE", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti#stop_time", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 129, "source": "https://ontology.unifiedcyberontology.org/uco/observable/MACAddress", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVTIMEO", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#basic_constraints", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/adversary#secondary_motivations", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#NetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 130, "source": "https://ontology.unifiedcyberontology.org/uco/observable/serviceStatus", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/data-marking#selectors", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SELECT_ERR_QUEUE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#groups", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdError", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_listening", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#is_active", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti#SHA3-256_hash_value", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_privileged", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_handle", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_alternative_name", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 131, "source": "https://ontology.unifiedcyberontology.org/uco/observable/ownerSID", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix/location#building_details", "http://docs.oasis-open.org/ns/cti/stix#Campaign", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/software#swid", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_last_login", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/adversary#goals", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 132, "source": "https://ontology.unifiedcyberontology.org/uco/observable/startType", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFlags", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXCountChars", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 133, "source": "https://ontology.unifiedcyberontology.org/uco/observable/URL", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix#Campaign", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti#postal_code", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 134, "source": "https://ontology.unifiedcyberontology.org/uco/observable/subjectPublicKeyModulus", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/file#name_enc", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#protocols", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti#SHA3-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSCRED", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti#ComplexType", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 135, "source": "https://ontology.unifiedcyberontology.org/uco/observable/WindowsPESection", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix#Campaign", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti/stix/software#swid", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix#NetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#is_active", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SELECT_ERR_QUEUE", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/directory#path_enc", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix#Sighting", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdError", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#Malware", "http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 136, "source": "https://ontology.unifiedcyberontology.org/uco/observable/subjectAlternativeName", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ACCEPTCONN", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#name_constraints", "http://docs.oasis-open.org/ns/cti/stix#Sighting", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DOMAIN", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 137, "source": "https://ontology.unifiedcyberontology.org/uco/observable/privateKeyUsagePeriodNotAfter", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_login", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdError", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_after", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEEK_OFF", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/malware#architecture_execution_envs", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 138, "source": "https://ontology.unifiedcyberontology.org/uco/observable/contentDisposition", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti/stix/ext/process#windows_title", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SELECT_ERR_QUEUE", "http://docs.oasis-open.org/ns/cti#revoked", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFillAttribute", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/message#content_disposition", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ERROR", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 139, "source": "https://ontology.unifiedcyberontology.org/uco/observable/IPv6Address", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti#languages", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_last_login", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_port", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix#NetworkTraffic", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 140, "source": "https://ontology.unifiedcyberontology.org/uco/observable/groups", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#is_optimized", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#groups", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 141, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sections", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_phases", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_login", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti#extensions", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 142, "source": "https://ontology.unifiedcyberontology.org/uco/observable/EmailAddress", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Campaign", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_byte_count", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#win32_version_value_hex", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_phases", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_packets", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 143, "source": "https://ontology.unifiedcyberontology.org/uco/observable/alternateDataStreams", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix#sample_ref", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti#extension_properties", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_descriptor", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSSEC", "http://docs.oasis-open.org/ns/cti#lang", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 144, "source": "https://ontology.unifiedcyberontology.org/uco/observable/impHash", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/file#name_enc", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti#SHA3-256_hash_value", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/malware#architecture_execution_envs", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_header_hashes", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti#type", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 145, "source": "https://ontology.unifiedcyberontology.org/uco/types/key", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/adversary#sophistication", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERCRED", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DOMAIN", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti#confidence", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs_id", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 146, "source": "https://ontology.unifiedcyberontology.org/uco/observable/sid", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 147, "source": "https://ontology.unifiedcyberontology.org/uco/observable/subjectPublicKeyAlgorithm", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs_id", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/file#name_enc", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti#SHA3-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 148, "source": "https://ontology.unifiedcyberontology.org/uco/observable/bodyMultipart", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_header_hashes", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BSDCOMPAT", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 149, "source": "https://ontology.unifiedcyberontology.org/uco/observable/ipfix", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdOutput", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#ipfix", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti#lang", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_packets", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 150, "source": "https://ontology.unifiedcyberontology.org/uco/location/longitude", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti#region", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti#latitude", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#crl_distribution_points", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 151, "source": "https://ontology.unifiedcyberontology.org/uco/observable/WindowsPEOptionalHeader", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/user-account#can_escalate_privs", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_OOBINLINE", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 152, "source": "https://ontology.unifiedcyberontology.org/uco/types/Hash", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_packets", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 153, "source": "https://ontology.unifiedcyberontology.org/uco/observable/version", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_first_login", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti#id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 154, "source": "https://ontology.unifiedcyberontology.org/uco/observable/version", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_first_login", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti#id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 155, "source": "https://ontology.unifiedcyberontology.org/uco/observable/version", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_image_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_first_login", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti#id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 156, "source": "https://ontology.unifiedcyberontology.org/uco/core/name", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ACCEPTCONN", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti#latitude", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DOMAIN", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 157, "source": "https://ontology.unifiedcyberontology.org/uco/core/statement", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/message#recevied_lines", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ERROR", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti#submitted", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 158, "source": "https://ontology.unifiedcyberontology.org/uco/observable/subject", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_first_login", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 159, "source": "https://ontology.unifiedcyberontology.org/uco/observable/subject", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_first_login", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#wShowWindow", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 160, "source": "https://ontology.unifiedcyberontology.org/uco/observable/validityNotAfter", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/network-traffic#is_active", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti#revoked", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_after", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix#KillChainPhase", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_listening", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/identity#sectors", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_last_login", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFlags", "http://docs.oasis-open.org/ns/cti#longitude", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 161, "source": "https://ontology.unifiedcyberontology.org/uco/observable/data", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/file#name_enc", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti/stix/message#recevied_lines", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 162, "source": "https://ontology.unifiedcyberontology.org/uco/observable/modifiedTime", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_last_login", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/process#created_time", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti#first_seen", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ACCEPTCONN", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti#languages", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 163, "source": "https://ontology.unifiedcyberontology.org/uco/observable/isServiceAccount", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSCRED", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BROADCAST", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwFlags", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BINDTODEVICE", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_service_account", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/infrastructure#infrastructure_types", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_login", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 164, "source": "https://ontology.unifiedcyberontology.org/uco/observable/RasterPictureFacet", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid0", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_listening", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#protocols", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#is_active", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 165, "source": "https://ontology.unifiedcyberontology.org/uco/observable/WindowsProcess", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdOutput", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_descriptor", "http://docs.oasis-open.org/ns/cti/stix/location#building_details", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_subsystem_version", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dep_enabled", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 166, "source": "https://ontology.unifiedcyberontology.org/uco/observable/Directory", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/file#size", "http://docs.oasis-open.org/ns/cti#region", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/adversary#primary_motivation", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#home_dir", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 167, "source": "https://ontology.unifiedcyberontology.org/uco/observable/accountType", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_last_login", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_height", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_sections", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_service_account", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 168, "source": "https://ontology.unifiedcyberontology.org/uco/tool/Tool", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 169, "source": "https://ontology.unifiedcyberontology.org/uco/observable/subjectKeyIdentifier", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti#latitude", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_privileged", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 170, "source": "https://ontology.unifiedcyberontology.org/uco/observable/policyConstraints", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti#confidence", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/message#content_disposition", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#basic_constraints", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#protocols", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_before", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 171, "source": "https://ontology.unifiedcyberontology.org/uco/observable/Note", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BUSY_POLL", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix#CourseOfAction", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/data-marking#selectors", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 172, "source": "https://ontology.unifiedcyberontology.org/uco/observable/X509Certificate", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/malware#is_family", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/location#building_details", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSSEC", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 173, "source": "https://ontology.unifiedcyberontology.org/uco/observable/privateKeyUsagePeriodNotBefore", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#home_dir", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BSDCOMPAT", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_after", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERCRED", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 174, "source": "https://ontology.unifiedcyberontology.org/uco/observable/context", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PROTOCOL", "http://docs.oasis-open.org/ns/cti/stix/message#body", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DOMAIN", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 175, "source": "https://ontology.unifiedcyberontology.org/uco/tool/swid", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#NetworkTraffic", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERCRED", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#file_alignment", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix/software#swid", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 176, "source": "https://ontology.unifiedcyberontology.org/uco/observable/optionalHeader", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti#first_seen", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_KEEPALIVE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 177, "source": "https://ontology.unifiedcyberontology.org/uco/core/Grouping", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_after", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#groups", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#basic_constraints", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti/stix#Software", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 178, "source": "https://ontology.unifiedcyberontology.org/uco/observable/AutonomousSystem", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix#IndustrySector", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix/message#body_raw_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix#CourseOfAction", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#ipfix", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix#KillChainPhase", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 179, "source": "https://ontology.unifiedcyberontology.org/uco/observable/path", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix#NetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#home_dir", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 180, "source": "https://ontology.unifiedcyberontology.org/uco/observable/canEscalatePrivs", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix/user-account#can_escalate_privs", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_CBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEADDR", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RXQ_OVFL", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/data-marking#selectors", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BUSY_POLL", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix#Vulnerability", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/message#content_disposition", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SELECT_ERR_QUEUE", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUF", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/message#recevied_lines", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVTIMEO", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#protocols", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSSEC", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ERROR", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 181, "source": "https://ontology.unifiedcyberontology.org/uco/observable/IPv4Address", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_image", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_port", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/data-marking#StatementMarking", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#is_active", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix#NetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/adversary#primary_motivation", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix#Location", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 182, "source": "https://ontology.unifiedcyberontology.org/uco/observable/WindowsRegistryKey", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti#extension_properties", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#number_of_subkeys", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_subsystem_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti#aliases", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti#mtime", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 183, "source": "https://ontology.unifiedcyberontology.org/uco/observable/crlDistributionPoints", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdError", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/directory#path_enc", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti/stix#sample_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RXQ_OVFL", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BUSY_POLL", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#crl_distribution_points", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_mappings", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 184, "source": "https://ontology.unifiedcyberontology.org/uco/observable/isOptimized", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti#confidence", "http://docs.oasis-open.org/ns/cti/stix#KillChainPhase", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_headers", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/ext/process#aslr_enabled", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_image_version", "http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#is_optimized", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 185, "source": "https://ontology.unifiedcyberontology.org/uco/core/description", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/x509-certificate#basic_constraints", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti/stix#Sighting", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_OOBINLINE", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_CBPF", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 186, "source": "https://ontology.unifiedcyberontology.org/uco/observable/WindowsService", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#Campaign", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix/message#from_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix/message#additional_header_fields", "http://docs.oasis-open.org/ns/cti/stix#Individual", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 187, "source": "https://ontology.unifiedcyberontology.org/uco/observable/icmpType", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#src_flags_hex", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#key_usage", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_type_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti#latitude", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#IcmpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_method", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti/stix/adversary#sophistication", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_port", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_packets", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_rva_and_sizes", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#ipfix", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 188, "source": "https://ontology.unifiedcyberontology.org/uco/observable/signatureAlgorithm", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#is_self_signed", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#magic_hex", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_handle", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti/stix/file#magic_number_hex", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_exponent", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti#MD5_hash_value", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti#TLSH_hash_value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti#key_identifier", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ERROR", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdOutput", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "http://docs.oasis-open.org/ns/cti#SHA3-256_hash_value", "http://docs.oasis-open.org/ns/cti#postal_code", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_port", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PROTOCOL", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_created", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti#Hashes", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 189, "source": "https://ontology.unifiedcyberontology.org/uco/observable/startTime", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_last_login", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/software#swid", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/process#created_time", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti/stix/software#cpe", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEEK_OFF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVTIMEO", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_os_version", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BUSY_POLL", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 190, "source": "https://ontology.unifiedcyberontology.org/uco/observable/isPrivileged", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/user-account#can_escalate_privs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BROADCAST", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LOCK_FILTER", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_LINGER", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_listening", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#loader_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_FILTER", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "http://docs.oasis-open.org/ns/cti/stix/malware#capabilities", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_CBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#is_active", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_privileged", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/process#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_login", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSCRED", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_service_account", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 191, "source": "https://ontology.unifiedcyberontology.org/uco/observable/UserAccount", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#base_of_data", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#NetworkSocket", "http://docs.oasis-open.org/ns/cti/stix/directory#path_enc", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix/adversary#sophistication", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_service_account", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti#modified", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 192, "source": "https://ontology.unifiedcyberontology.org/uco/observable/shell", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#image_width", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "http://docs.oasis-open.org/ns/cti/stix#Malware", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_CBPF", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti/stix/process#cwd", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dep_enabled", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdOutput", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PASSCRED", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti#lang", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PROTOCOL", "http://docs.oasis-open.org/ns/cti/stix/directory#path_enc", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DONTROUTE", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_login", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs_id", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_EBPF", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwX", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix/ext/process#windows_title", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 193, "source": "https://ontology.unifiedcyberontology.org/uco/core/ExternalReference", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEEK_OFF", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#basic_constraints", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#validity_not_after", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_REUSEPORT_CBPF", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_code", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 194, "source": "https://ontology.unifiedcyberontology.org/uco/observable/MimePartType", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_optional_header", "http://docs.oasis-open.org/ns/cti#mime_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#address_family", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdInput", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RXQ_OVFL", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulates_refs_id", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/message#is_multipart", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti#lang", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 195, "source": "https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Malware", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti#region", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/data-marking#GranularMarking", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref_id", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 196, "source": "http://www.essepuntato.it/2009/10/error/hasError", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ERROR", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix#CourseOfAction", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti#revoked", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SELECT_ERR_QUEUE", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#bits_per_pixel", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pointer_to_symbol_table_hex", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti/stix#NetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdError", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#address_of_entry_point", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVBUFFORCE", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_MARK", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_commit", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_REUSEPORT", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 197, "source": "https://ontology.unifiedcyberontology.org/uco/action/Action", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#Malware", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Sighting", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERCRED", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_privileged", "http://docs.oasis-open.org/ns/cti/stix#KillChainPhase", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsService", "http://docs.oasis-open.org/ns/cti/stix#defanged", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcess", "http://docs.oasis-open.org/ns/cti/stix#Campaign", "http://docs.oasis-open.org/ns/cti/stix#object_ref", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/artifact#encryption_algorithm", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix#CourseOfAction", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#HttpRequest", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#creator_user_ref", "http://docs.oasis-open.org/ns/cti/stix/artifact#decryption_key", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 198, "source": "https://ontology.unifiedcyberontology.org/uco/identity/familyName", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix/user-account#display_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti/stix/email-address#display_name", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#alternative_data_streams", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix/malware#is_family", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti#hash_algorithm", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti#authors", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERCRED", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/core#RelationshipObject", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#display_name", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 199, "source": "https://ontology.unifiedcyberontology.org/uco/observable/Observation", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#KillChainPhase", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti/stix#Sighting", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix#Grouping", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#Opinion", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix#CourseOfAction", "http://docs.oasis-open.org/ns/cti/stix#AttackPattern", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVLOWAT", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix#Organization", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYSize", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti#languages", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti#hashes", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DOMAIN", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix#Incident", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix#Country", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 200, "source": "https://ontology.unifiedcyberontology.org/uco/observable/pid", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#authority_key_identifier", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#sid", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#dst_flags_hex", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti#modified", "http://docs.oasis-open.org/ns/cti#external_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#image_base", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_port", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_os_version", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDTIMEO", "http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/artifact#payload_bin", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#inhibit_any_policy", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#gid", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 201, "source": "https://ontology.unifiedcyberontology.org/uco/action/actionCount", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#is_optimized", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEERSEC", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#rir", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#certificate_policies", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_alternative_name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#TcpNetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_packets", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti#published", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#is_active", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/malware#result", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti/stix/user-account#is_disabled", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti#extensions", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 202, "source": "https://ontology.unifiedcyberontology.org/uco/action/argumentName", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix/message#subject", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_ATTACH_BPF", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix#GlobalPosition", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_handle", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#home_dir", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#SHA-256_hash_value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs_id", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 203, "source": "https://ontology.unifiedcyberontology.org/uco/action/endTime", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/process#created_time", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti#longitude", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix#Note", "http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti#mtime", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix#NetworkTraffic", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMP", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BROADCAST", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix#Report", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti#ctime", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#issuer", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#ipfix", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/language-content#object_modified", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti#atime", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_RCVTIMEO", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#modified_time", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti#analysis_ended", "http://docs.oasis-open.org/ns/cti#stop_time", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_byte_count", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 204, "source": "https://ontology.unifiedcyberontology.org/uco/action/environment", "type": "OPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#exif_tags", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/observed-data#first_observed", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/stix#kill_chain_phases", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref", "http://docs.oasis-open.org/ns/cti/stix/process#environment_variables", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/process#startup_info", "http://docs.oasis-open.org/ns/cti/data-marking#granular_markings", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref", "http://docs.oasis-open.org/ns/cti#SHA-1_hash_value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_data_ref", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/directory#path_enc", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti#SHA-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix/malware#architecture_execution_envs", "http://docs.oasis-open.org/ns/cti/stix#sample_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#sections", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs_id", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDBUF", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti/stix/malware#operating_system_refs", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 205, "source": "https://ontology.unifiedcyberontology.org/uco/action/trend", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti/stix#MalwareAnalysis", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti/stix/message#recevied_lines", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#imphash", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_byte_count", "http://docs.oasis-open.org/ns/cti/stix/malware#malware_types", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_port", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti#url", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#crl_distribution_points", "http://docs.oasis-open.org/ns/cti#extension_properties", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti/stix#Indicator", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_handle", "http://docs.oasis-open.org/ns/cti/stix/observed-data#last_observed", "http://docs.oasis-open.org/ns/cti/stix/message#raw_email_ref", "http://docs.oasis-open.org/ns/cti/stix#Campaign", "http://docs.oasis-open.org/ns/cti#last_seen", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_before", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_login", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_type", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#sighting_of_ref_id", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#number_of_symbols", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs", "http://docs.oasis-open.org/ns/cti#SSDEEP_hash_value", "http://docs.oasis-open.org/ns/cti/stix/process#pid", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#signature_algorithm", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 206, "source": "https://ontology.unifiedcyberontology.org/uco/action/value", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/adversary#resource_level", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_ref_id", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs_id", "http://docs.oasis-open.org/ns/cti#valid_from", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/process#start_type", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/ext/process#hStdError", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs_id", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_key_identifier", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 207, "source": "https://ontology.unifiedcyberontology.org/uco/analysis/class", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#icmp_code_hex", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix#ObservedData", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti/stix/adversary#roles", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_reserve", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#start", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DEBUG", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#end", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_DETACH_BPF", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#is_blocking", "http://docs.oasis-open.org/ns/cti#extensions", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#message_body_length", "http://docs.oasis-open.org/ns/cti/data-marking#tlp", "http://docs.oasis-open.org/ns/cti/stix/malware#modules", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_initialized_data", "http://docs.oasis-open.org/ns/cti/stix/malware#product", "http://docs.oasis-open.org/ns/cti#SHA3-512_hash_value", "http://docs.oasis-open.org/ns/cti/stix/location#network_details", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti#administrative_area", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 208, "source": "https://ontology.unifiedcyberontology.org/uco/configuration/dependencyDescription", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/network-traffic#protocols", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_NAPI_ID", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TIMESTAMPNS", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#major_linker_version", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_descriptor", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/stix/file#entropy", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix#ThreatActor", "http://docs.oasis-open.org/ns/cti/stix/message#cc_refs", "http://docs.oasis-open.org/ns/cti/stix/tool#tool_types", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix/indicator#indicator_types", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#external_references", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/ip-address#belongs_to_refs", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dep_enabled", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/malware#implementation_languages", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/malware#host_vm_ref_id", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_definition_version", "http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix#Mutex", "http://docs.oasis-open.org/ns/cti/stix/software#swid", "http://docs.oasis-open.org/ns/cti/stix/report#report_types", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#crl_distribution_points", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/campaign#objective", "http://docs.oasis-open.org/ns/cti#description", "http://docs.oasis-open.org/ns/cti/stix/message#bcc_refs", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 209, "source": "https://ontology.unifiedcyberontology.org/uco/configuration/dependencyType", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_ref_id", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti/stix/ext/process#integrity_level", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti#ComplexType", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_version", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix#contains_refs_id", "http://docs.oasis-open.org/ns/cti/stix/opinion#explanation", "http://docs.oasis-open.org/ns/cti/stix#Sighting", "http://docs.oasis-open.org/ns/cti/stix/file#content_ref_id", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti#valid_until", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_TYPE", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ip-address#resolves_to_refs", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs_id", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref_id", "http://docs.oasis-open.org/ns/cti/stix/domain-name#resolves_to_refs", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti#spec_version", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_BSDCOMPAT", "http://docs.oasis-open.org/ns/cti/stix#extension_type", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#start_time", "http://docs.oasis-open.org/ns/cti/stix#sample_refs", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#contains_refs_id", "http://docs.oasis-open.org/ns/cti/data-marking#marking_ref_id", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/malware#configuration_version", "http://docs.oasis-open.org/ns/cti#lang", "http://docs.oasis-open.org/ns/cti/stix#Relationship", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/adversary#personal_motivations", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 210, "source": "https://ontology.unifiedcyberontology.org/uco/configuration/itemName", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti/stix/malware#installed_software_refs_id", "http://docs.oasis-open.org/ns/cti/stix#object_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#aslr_enabled", "http://docs.oasis-open.org/ns/cti/stix#analysis_sco_refs_id", "http://docs.oasis-open.org/ns/cti#name", "http://docs.oasis-open.org/ns/cti/stix#phase_name", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#version", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#pdfid1", "http://docs.oasis-open.org/ns/cti/stix/ext/process#group_name", "http://docs.oasis-open.org/ns/cti/data-marking#object_marking_refs", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/process#child_refs_id", "http://docs.oasis-open.org/ns/cti/stix#sample_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/identity#identity_class", "http://docs.oasis-open.org/ns/cti/stix#sample_ref_id", "http://docs.oasis-open.org/ns/cti/stix/sighting#observed_data_refs", "http://docs.oasis-open.org/ns/cti#id", "http://docs.oasis-open.org/ns/cti/stix#object_ref_id", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#document_info_dict", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/directory#path", "http://docs.oasis-open.org/ns/cti#source_name", "http://docs.oasis-open.org/ns/cti/stix/relationship#target_ref_id", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti#schema", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#groups", "http://docs.oasis-open.org/ns/cti#version", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpTitle", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix/process#parent_ref_id", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PEEK_OFF", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/process#descriptions", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/malware#version", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 211, "source": "https://ontology.unifiedcyberontology.org/uco/observable/values", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/ext/process#cb", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix/message#to_refs_id", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#AlternateDataStream", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref_id", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#optional_header", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwYCountChars", "http://docs.oasis-open.org/ns/cti/stix/observed-data#objects", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_byte_count", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/relationship#source_ref", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#private_key_usage_period_not_after", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#dst_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/ext/process#owner_sid", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#country", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#IPv6Address", "http://docs.oasis-open.org/ns/cti/stix/malware#result_name", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/data-marking#definition_type", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#time_date_stamp", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti#object_type", "http://docs.oasis-open.org/ns/cti#extension_types", "http://docs.oasis-open.org/ns/cti/stix/adversary#personal_motivations", "http://docs.oasis-open.org/ns/cti#vendor", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_dll_refs_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti#hash_value", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 212, "source": "https://ontology.unifiedcyberontology.org/uco/core/value", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#key", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#minor_linker_version", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_type", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_name", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/observed-data#number_observed", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/process#lpDesktop", "http://docs.oasis-open.org/ns/cti/stix/identity#roles", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti#created_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_header", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#policy_constraints", "http://docs.oasis-open.org/ns/cti/stix/sighting#where_sighted_refs_id", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_algorithm", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_PRIORITY", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 213, "source": "https://ontology.unifiedcyberontology.org/uco/observable/value", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/malware#analysis_engine_version", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/process#image_ref", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_packets", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject_public_key_modulus", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti#city", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_CPU", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#subject", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/malware#is_family", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#shell", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/user-account#credential_last_changed", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#src_payload_ref", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix#object_refs", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_stack_reserve", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix#CourseOfAction", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 214, "source": "https://ontology.unifiedcyberontology.org/uco/observable/WindowsPEFileHeader", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti#submitted", "http://docs.oasis-open.org/ns/cti/stix/ext/ntfs-file#NtfsFile", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_heap_commit", "http://docs.oasis-open.org/ns/cti/stix#File", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#PDFFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#machine_hex", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_expires", "http://docs.oasis-open.org/ns/cti/stix/core#Object", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#comment", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#extended_key_usage", "http://docs.oasis-open.org/ns/cti/stix#Tool", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwXSize", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti/stix/ext/process#WindowsProcessStartupInfo", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix#EmailMessage", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEFile", "http://docs.oasis-open.org/ns/cti/stix/file#checksum_hex", "http://docs.oasis-open.org/ns/cti/stix#Location", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SocketOptions", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_OOBINLINE", "http://docs.oasis-open.org/ns/cti/stix#LanguageContent", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#pe_type", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#subsystem_hex", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/data-marking#MarkingDefinition", "http://docs.oasis-open.org/ns/cti/stix/ext/archive-file#ArchiveFile", "http://docs.oasis-open.org/ns/cti/stix#X509Certificate", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPESection", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix/core#MetaObject", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#X509v3Extensions", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEOptionalHeader", "http://docs.oasis-open.org/ns/cti/stix/identity#contact_information", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#WindowsPEBinaryFile", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#win32_version_value_hex", "http://docs.oasis-open.org/ns/cti#Hashes", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix/message#body_multipart", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#x509_v3_extensions", "http://docs.oasis-open.org/ns/cti/stix#Vulnerability", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#dll_characteristics_hex", "http://docs.oasis-open.org/ns/cti/stix#Software", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 215, "source": "https://ontology.unifiedcyberontology.org/uco/types/value", "type": "DPROP", "candidates": ["http://docs.oasis-open.org/ns/cti#content", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#options", "http://docs.oasis-open.org/ns/cti#type", "http://docs.oasis-open.org/ns/cti/stix/message#date_sent", "http://docs.oasis-open.org/ns/cti/stix/email-address#value", "http://docs.oasis-open.org/ns/cti/stix/opinion#opinion", "http://docs.oasis-open.org/ns/cti/stix/ext/process#dwY", "http://docs.oasis-open.org/ns/cti/stix/ext/windows-pebinary-file#size_of_uninitialized_data", "http://docs.oasis-open.org/ns/cti/stix/autonomous-system#number", "http://docs.oasis-open.org/ns/cti/stix/relationship#relationship_type", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/process#priority", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix/domain-name#value", "http://docs.oasis-open.org/ns/cti#labels", "http://docs.oasis-open.org/ns/cti/stix/message#sender_ref_id", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#values", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#request_value", "http://docs.oasis-open.org/ns/cti#hash_value", "http://docs.oasis-open.org/ns/cti#precision", "http://docs.oasis-open.org/ns/cti/stix/message#message_id", "http://docs.oasis-open.org/ns/cti#abstract", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#basic_constraints", "http://docs.oasis-open.org/ns/cti/stix/network-traffic#encapsulated_by_ref_id", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti#created_by_ref", "http://docs.oasis-open.org/ns/cti#street_address", "http://docs.oasis-open.org/ns/cti/stix/x509-certificate#serial_number", "http://docs.oasis-open.org/ns/cti#created", "http://docs.oasis-open.org/ns/cti/stix/grouping#context", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#socket_descriptor", "http://docs.oasis-open.org/ns/cti/stix/file#parent_directory_ref_id", "http://docs.oasis-open.org/ns/cti/stix/language-content#contents", "http://docs.oasis-open.org/ns/cti/stix#Vulnerability", "http://docs.oasis-open.org/ns/cti#key_value", "http://docs.oasis-open.org/ns/cti/stix/indicator#pattern_version", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti#confidence", "http://docs.oasis-open.org/ns/cti#count", "http://docs.oasis-open.org/ns/cti/stix/ip-address#value", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix#contains_refs", "http://docs.oasis-open.org/ns/cti#Hash", "http://docs.oasis-open.org/ns/cti/stix/message#content_type", "http://docs.oasis-open.org/ns/cti/stix/mac-address#value", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SELECT_ERR_QUEUE", "http://docs.oasis-open.org/ns/cti/stix/uri#value", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "https://oaei.ontologymatching.org/2026/diso/NIL"]}
{"qid": 216, "source": "https://ontology.unifiedcyberontology.org/uco/observable/PhoneAccount", "type": "CLS", "candidates": ["http://docs.oasis-open.org/ns/cti/stix#IPv4Address", "http://docs.oasis-open.org/ns/cti/stix#CourseOfAction", "http://docs.oasis-open.org/ns/cti#Object", "http://docs.oasis-open.org/ns/cti/stix#EmailAddress", "http://docs.oasis-open.org/ns/cti#ExtensionDefinition", "http://docs.oasis-open.org/ns/cti/stix#MACAddress", "http://docs.oasis-open.org/ns/cti/stix#Campaign", "http://docs.oasis-open.org/ns/cti/stix#DomainName", "http://docs.oasis-open.org/ns/cti#ExternalReference", "http://docs.oasis-open.org/ns/cti/stix#Region", "http://docs.oasis-open.org/ns/cti/data-marking#statement", "http://docs.oasis-open.org/ns/cti/stix/ext/pdf-file#is_optimized", "http://docs.oasis-open.org/ns/cti/data-marking#TLPMarking", "http://docs.oasis-open.org/ns/cti/stix/process#opened_connection_refs", "http://docs.oasis-open.org/ns/cti#analysis_started", "http://docs.oasis-open.org/ns/cti/stix#URL", "http://docs.oasis-open.org/ns/cti#latitude", "http://docs.oasis-open.org/ns/cti/stix/core#CyberObservable", "http://docs.oasis-open.org/ns/cti/stix#Group", "http://docs.oasis-open.org/ns/cti/stix#Process", "http://docs.oasis-open.org/ns/cti/stix#InstrusionSet", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_INCOMING_NAPI_ID", "http://docs.oasis-open.org/ns/cti/stix#WindowsRegistryKey", "http://docs.oasis-open.org/ns/cti#KeyValuePair", "http://docs.oasis-open.org/ns/cti/stix/ext/network-traffic#SO_SNDLOWAT", "http://docs.oasis-open.org/ns/cti/stix/user-account#user_id", "http://docs.oasis-open.org/ns/cti/stix#Infrastructure", "http://docs.oasis-open.org/ns/cti/stix#Directory", "http://docs.oasis-open.org/ns/cti/stix/message#EmailMimePart", "http://docs.oasis-open.org/ns/cti#Identity", "http://docs.oasis-open.org/ns/cti/stix/user-account#account_type", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#WindowsRegistryValue", "http://docs.oasis-open.org/ns/cti/stix#Individual", "http://docs.oasis-open.org/ns/cti/stix/email-address#belongs_to_ref_id", "http://docs.oasis-open.org/ns/cti/stix/ext/raster-image-file#RasterImageFile", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#data_type", "http://docs.oasis-open.org/ns/cti/stix/windows-registry#name", "http://docs.oasis-open.org/ns/cti/stix#Artifact", "http://docs.oasis-open.org/ns/cti/stix/sighting#summary", "http://docs.oasis-open.org/ns/cti/stix#UserAccount", "http://docs.oasis-open.org/ns/cti/stix#AutonomousSystem", "http://docs.oasis-open.org/ns/cti/stix/ext/unix-user-account#UnixUserAccount", "http://docs.oasis-open.org/ns/cti/stix/core#DomainObject", "http://docs.oasis-open.org/ns/cti/stix#Country", "http://docs.oasis-open.org/ns/cti/stix/ext/process#service_status", "http://docs.oasis-open.org/ns/cti/stix#CivicLocation", "http://docs.oasis-open.org/ns/cti/stix#Identity", "http://docs.oasis-open.org/ns/cti/stix/process#command_line", "http://docs.oasis-open.org/ns/cti/stix/process#is_hidden", "https://oaei.ontologymatching.org/2026/diso/NIL"]}