Ontology & Fusion
Ledger Vocabulary
Allowed subject classes, identifiers, methods, predicates, and verification states.
Values outside these lists are rejected. Terms marked Y2 profile add issuer and supply-chain research terms. They use the same evidence, verification, and interval rules.
Subject classes
| Class | Examples |
|---|---|
person | A researcher, an executive, a maintainer |
organization | A company, a vendor, an agency, a threat group identified by its ATT&CK ID |
system | A site, a host, a repository, a service, a model, an autonomous system |
Designator kinds
| Kind | Value | Namespace |
|---|---|---|
published-name | The name as the page prints it | Not used |
pseudonym | A name sources present as an alias | Not used |
handle | The login, without @ | Platform or host, such as github.com |
email | Lowercase addr-spec | Not used |
url | Exact http(s) URL without userinfo | Not used |
domain, hostname | Lowercase host, no trailing dot | Not used |
asn | AS and a decimal number | Not used |
public-key | Lowercase hex fingerprint | Algorithm, such as ssh-ed25519 |
external-id | A registry identifier | wikidata (Q…), lei (20 characters with valid check digits), attack-group (G and four digits), sec-cik (ten digits, Y2 profile) |
ticker (Y2 profile) | Uppercase listed symbol | ISO 10383 exchange MIC, such as XNAS |
Observation methods
public-web-page, public-profile, public-dns, certificate-transparency, public-archive,
public-registry, public-code-host, and analyst-note.
Authenticated access, non-public access, and interaction with the subject are not supported observation methods.
Predicates
| Predicate | From | To | Meaning |
|---|---|---|---|
designated-by | subject | designator | The subject is referred to by this identifier |
preferred-label | subject | name designator | Display this name. Requires a live designated-by. |
same-as | subject | subject of the same class | Hypothesis that the rows are one entity |
distinct-from | subject | subject of the same class | Hypothesis that they are not |
member-of | person | organization | A public role, in qualifier |
affiliated-with | subject | subject | A weaker public tie |
controls | person or organization | system or designator | Claimed control, supported by a source that addresses control |
operates | person or organization | system | A source says this party runs that system |
resolves-to | designator | designator | A public resolution for the interval observed |
follows | handle | handle | A public page shows one account following another |
supplies (Y2 profile) | organization | organization | The first supplies goods or services to the second |
subsidiary-of (Y2 profile) | organization | organization | The first is owned or controlled by the second |
same-as and distinct-from never merge rows. When both are live for a pair, the pair is contested.
Verification ladder
Verification belongs to a claim, not to a subject.
| State | Honest use | Evidence the ledger requires |
|---|---|---|
unverified | Written down, not checked | At least one observation |
mentioned | The string appeared without a supported link | A public retrieval |
located | One retrieved page ties them | A public retrieval |
self-asserted | The subject's own page states it | A public retrieval |
cross-linked | Two retrieved pages identify the link | Retrievals of two different pages |
corroborated | A further independent source agrees | Retrievals of two different pages |
contradicted | A source disputes the link | A public retrieval |
stale | The page is gone or no longer shows it | A public retrieval |
analytic | The only support is an analyst note | Only analyst notes |
A claim supported only by notes is analytic or unverified.
Source grades
| Grade | Meaning |
|---|---|
primary | A direct source, such as a profile, staff page, or registry entry |
secondary | The page reports on the thing |
analytic | An analyst note that cites the observations it connects |