synapse 2.164.0__py311-none-any.whl → 2.166.0__py311-none-any.whl

synapse/models/inet.py

@@ -1304,8 +1304,8 @@ class InetModule(s_module.CoreModule):
                     }),
 
                     ('inet:ssl:cert', ('comp', {'fields': (('server', 'inet:server'), ('file', 'file:bytes'))}), {
-                        'doc': 'An SSL certificate file served by a server.',
-                        'ex': '(1.2.3.4:443, guid:d41d8cd98f00b204e9800998ecf8427e)',
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use inet:tls:servercert or inet:tls:clientcert',
                     }),
 
                     ('inet:port', ('int', {'min': 0, 'max': 0xffff}), {
@@ -1489,6 +1489,24 @@ class InetModule(s_module.CoreModule):
                     ('inet:ssl:jarmsample', ('comp', {'fields': (('server', 'inet:server'), ('jarmhash', 'inet:ssl:jarmhash'))}), {
                         'doc': 'A JARM hash sample taken from a server.'}),
 
+                    ('inet:tls:handshake', ('guid', {}), {
+                        'doc': 'An instance of a TLS handshake between a server and client.'}),
+
+                    ('inet:tls:ja3s:sample', ('comp', {'fields': (('server', 'inet:server'), ('ja3s', 'hash:md5'))}), {
+                        'doc': 'A JA3 sample taken from a server.'}),
+
+                    ('inet:tls:ja3:sample', ('comp', {'fields': (('client', 'inet:client'), ('ja3', 'hash:md5'))}), {
+                        'doc': 'A JA3 sample taken from a client.'}),
+
+                    ('inet:tls:servercert', ('comp', {'fields': (('server', 'inet:server'), ('cert', 'crypto:x509:cert'))}), {
+                        'doc': 'An x509 certificate sent by a server for TLS.',
+                        'ex': '(1.2.3.4:443, c7437790af01ae1bb2f8f3b684c70bf8)',
+                    }),
+
+                    ('inet:tls:clientcert', ('comp', {'fields': (('client', 'inet:client'), ('cert', 'crypto:x509:cert'))}), {
+                        'doc': 'An x509 certificate sent by a client for TLS.',
+                        'ex': '(1.2.3.4:443, 3fdf364e081c14997b291852d1f23868)',
+                    }),
                 ),
 
                 'interfaces': (
@@ -1569,6 +1587,9 @@ class InetModule(s_module.CoreModule):
                         ('received:from:fqdn', ('inet:fqdn', {}), {
                             'doc': 'The sending server FQDN, potentially from the Received: header.'}),
 
+                        ('flow', ('inet:flow', {}), {
+                            'doc': 'The inet:flow which delivered the message.'}),
+
                     )),
 
                     ('inet:email:header', {}, (
@@ -3231,6 +3252,60 @@ class InetModule(s_module.CoreModule):
                             'doc': 'The server that was sampled to compute the JARM hash.'}),
                     )),
 
+                    ('inet:tls:handshake', {}, (
+                        ('time', ('time', {}), {
+                            'doc': 'The time the handshake was initiated.'}),
+                        ('flow', ('inet:flow', {}), {
+                            'doc': 'The raw inet:flow associated with the handshake.'}),
+                        ('server', ('inet:server', {}), {
+                            'doc': 'The TLS server during the handshake.'}),
+                        ('server:cert', ('crypto:x509:cert', {}), {
+                            'doc': 'The x509 certificate sent by the server during the handshake.'}),
+                        ('server:fingerprint:ja3', ('hash:md5', {}), {
+                            'doc': 'The JA3S finger of the server.'}),
+                        ('client', ('inet:client', {}), {
+                            'doc': 'The TLS client during the handshake.'}),
+                        ('client:cert', ('crypto:x509:cert', {}), {
+                            'doc': 'The x509 certificate sent by the client during the handshake.'}),
+                        ('client:fingerprint:ja3', ('hash:md5', {}), {
+                            'doc': 'The JA3 fingerprint of the client.'}),
+                    )),
+
+                    ('inet:tls:ja3s:sample', {}, (
+                        ('server', ('inet:server', {}), {
+                            'ro': True,
+                            'doc': 'The server that was sampled to produce the JA3S hash.'}),
+                        ('ja3s', ('hash:md5', {}), {
+                            'ro': True,
+                            'doc': "The JA3S hash computed from the server's TLS hello packet."})
+                    )),
+
+                    ('inet:tls:ja3:sample', {}, (
+                        ('client', ('inet:client', {}), {
+                            'ro': True,
+                            'doc': 'The client that was sampled to produce the JA3 hash.'}),
+                        ('ja3', ('hash:md5', {}), {
+                            'ro': True,
+                            'doc': "The JA3 hash computed from the client's TLS hello packet."})
+                    )),
+
+                    ('inet:tls:servercert', {}, (
+                        ('server', ('inet:server', {}), {
+                            'ro': True,
+                            'doc': 'The server associated with the x509 certificate.'}),
+                        ('cert', ('crypto:x509:cert', {}), {
+                            'ro': True,
+                            'doc': 'The x509 certificate sent by the server.'})
+                    )),
+
+                    ('inet:tls:clientcert', {}, (
+                        ('client', ('inet:client', {}), {
+                            'ro': True,
+                            'doc': 'The client associated with the x509 certificate.'}),
+                        ('cert', ('crypto:x509:cert', {}), {
+                            'ro': True,
+                            'doc': 'The x509 certificate sent by the client.'})
+                    )),
                 ),
             }),
         )

synapse/models/infotech.py

@@ -381,7 +381,7 @@ class ItModule(s_module.CoreModule):
                     'doc': "A vulnerability scan result for an asset."}),
 
                 ('it:mitre:attack:status', ('str', {'enums': 'current,deprecated,withdrawn'}), {
-                    'doc': 'A Mitre ATT&CK element status.',
+                    'doc': 'A MITRE ATT&CK element status.',
                     'ex': 'current',
                 }),
                 ('it:mitre:attack:matrix', ('str', {'enums': 'enterprise,mobile,ics'}), {
@@ -389,31 +389,31 @@ class ItModule(s_module.CoreModule):
                     'ex': 'enterprise',
                 }),
                 ('it:mitre:attack:group', ('str', {'regex': r'^G[0-9]{4}$'}), {
-                    'doc': 'A Mitre ATT&CK Group ID.',
+                    'doc': 'A MITRE ATT&CK Group ID.',
                     'ex': 'G0100',
                 }),
                 ('it:mitre:attack:tactic', ('str', {'regex': r'^TA[0-9]{4}$'}), {
-                    'doc': 'A Mitre ATT&CK Tactic ID.',
+                    'doc': 'A MITRE ATT&CK Tactic ID.',
                     'ex': 'TA0040',
                 }),
                 ('it:mitre:attack:technique', ('str', {'regex': r'^T[0-9]{4}(.[0-9]{3})?$'}), {
-                    'doc': 'A Mitre ATT&CK Technique ID.',
+                    'doc': 'A MITRE ATT&CK Technique ID.',
                     'ex': 'T1548',
                 }),
                 ('it:mitre:attack:mitigation', ('str', {'regex': r'^M[0-9]{4}$'}), {
-                    'doc': 'A Mitre ATT&CK Mitigation ID.',
+                    'doc': 'A MITRE ATT&CK Mitigation ID.',
                     'ex': 'M1036',
                 }),
                 ('it:mitre:attack:software', ('str', {'regex': r'^S[0-9]{4}$'}), {
-                    'doc': 'A Mitre ATT&CK Software ID.',
+                    'doc': 'A MITRE ATT&CK Software ID.',
                     'ex': 'S0154',
                 }),
                 ('it:mitre:attack:campaign', ('str', {'regex': r'^C[0-9]{4}$'}), {
-                    'doc': 'A Mitre ATT&CK Campaign ID.',
+                    'doc': 'A MITRE ATT&CK Campaign ID.',
                     'ex': 'C0028',
                 }),
                 ('it:mitre:attack:flow', ('guid', {}), {
-                    'doc': 'A Mitre ATT&CK Flow diagram.',
+                    'doc': 'A MITRE ATT&CK Flow diagram.',
                 }),
                 ('it:dev:str', ('str', {}), {
                     'doc': 'A developer selected string.'
@@ -1183,7 +1183,7 @@ class ItModule(s_module.CoreModule):
                     }),
                 )),
                 ('it:mitre:attack:technique', {}, (
-                    ('name', ('str', {'strip': True}), {
+                    ('name', ('str', {'lower': True, 'onespace': True}), {
                         'doc': 'The primary name for the ATT&CK technique.',
                     }),
                     ('matrix', ('it:mitre:attack:matrix', {}), {
@@ -1251,7 +1251,7 @@ class ItModule(s_module.CoreModule):
                 )),
                 ('it:mitre:attack:mitigation', {}, (
                     # TODO map to an eventual risk:mitigation
-                    ('name', ('str', {'strip': True}), {
+                    ('name', ('str', {'lower': True, 'onespace': True}), {
                         'doc': 'The primary name for the ATT&CK mitigation.',
                     }),
                     ('matrix', ('it:mitre:attack:matrix', {}), {
@@ -1312,9 +1312,9 @@ class ItModule(s_module.CoreModule):
                     ('period', ('ival', {}), {
                         'doc': 'The time interval when the campaign was active.'}),
                     ('created', ('time', {}), {
-                        'doc': 'The time that the campaign was created by Mitre.'}),
+                        'doc': 'The time that the campaign was created by MITRE.'}),
                     ('updated', ('time', {}), {
-                        'doc': 'The time that the campaign was last updated by Mitre.'}),
+                        'doc': 'The time that the campaign was last updated by MITRE.'}),
 
                     ('tag', ('syn:tag', {}), {
                         'deprecated': True,

synapse/models/orgs.py

@@ -24,14 +24,27 @@ class OuModule(s_module.CoreModule):
                 }),
                 ('ou:isic', ('str', {'regex': r'^[A-Z]([0-9]{2}[0-9]{0,2})?$'}), {
                     'doc': 'An International Standard Industrial Classification of All Economic Activities (ISIC) code.',
-                    'ex': 'C1393',
-                }),
+                    'ex': 'C1393'}),
+
                 ('ou:org', ('guid', {}), {
                     'doc': 'A GUID for a human organization such as a company or military unit.',
-                }),
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'name'}},
+                            {'type': 'prop', 'opts': {'name': 'names'}},
+                            {'type': 'prop', 'opts': {'name': 'country:code'}},
+                        ),
+                    }}),
+
                 ('ou:team', ('guid', {}), {
                     'doc': 'A GUID for a team within an organization.',
-                }),
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'name'}},
+                            {'type': 'prop', 'opts': {'name': 'org::name'}},
+                        ),
+                    }}),
+
                 ('ou:orgtype', ('taxonomy', {}), {
                     'doc': 'An org type taxonomy.',
                     'interfaces': ('meta:taxonomy',),
@@ -49,6 +62,11 @@ class OuModule(s_module.CoreModule):
                 }),
                 ('ou:industry', ('guid', {}), {
                     'doc': 'An industry classification type.',
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'name'}},
+                        ),
+                    },
                 }),
                 ('ou:industry:type:taxonomy', ('taxonomy', {}), {
                     'interfaces': ('meta:taxonomy',),
@@ -113,6 +131,12 @@ class OuModule(s_module.CoreModule):
                 }),
                 ('ou:conference', ('guid', {}), {
                     'doc': 'A conference with a name and sponsoring org.',
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'name'}},
+                            {'type': 'prop', 'opts': {'name': 'start'}},
+                        ),
+                    },
                 }),
                 ('ou:conference:attendee', ('comp', {'fields': (('conference', 'ou:conference'), ('person', 'ps:person'))}), {
                     'deprecated': True,
@@ -133,6 +157,11 @@ class OuModule(s_module.CoreModule):
                 }),
                 ('ou:goal', ('guid', {}), {
                     'doc': 'An assessed or stated goal which may be abstract or org specific.',
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'name'}},
+                        ),
+                    },
                 }),
                 ('ou:goalname', ('str', {'lower': True, 'onespace': True}), {
                     'doc': 'A goal name.',
@@ -154,16 +183,31 @@ class OuModule(s_module.CoreModule):
 
                 ('ou:campaign', ('guid', {}), {
                     'doc': "Represents an org's activity in pursuit of a goal.",
-                }),
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'name'}},
+                            {'type': 'prop', 'opts': {'name': 'names'}},
+                            {'type': 'prop', 'opts': {'name': 'reporter:name'}},
+                            {'type': 'prop', 'opts': {'name': 'tag'}},
+                        ),
+                    }}),
+
                 ('ou:conflict', ('guid', {}), {
                     'doc': 'Represents a conflict where two or more campaigns have mutually exclusive goals.',
                 }),
                 ('ou:contribution', ('guid', {}), {
-                    'doc': 'Represents a specific instance of contributing material support to a campaign.',
-                }),
+                    'doc': 'Represents a specific instance of contributing material support to a campaign.'}),
+
                 ('ou:technique', ('guid', {}), {
                     'doc': 'A specific technique used to achieve a goal.',
-                }),
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'name'}},
+                            {'type': 'prop', 'opts': {'name': 'reporter:name'}},
+                            {'type': 'prop', 'opts': {'name': 'tag'}},
+                        ),
+                    }}),
+
                 ('ou:technique:taxonomy', ('taxonomy', {}), {
                     'interfaces': ('meta:taxonomy',),
                     'doc': 'An analyst defined taxonomy to classify techniques in different disciplines.',
@@ -223,6 +267,10 @@ class OuModule(s_module.CoreModule):
                     'doc': 'The contribution includes the specific node.'}),
                 ((None, 'meets', 'ou:requirement'), {
                     'doc': 'The requirement is met by the source node.'}),
+                (('ou:org', 'has', None), {
+                    'doc': 'The organization is or was in possession of the target node.'}),
+                (('ou:org', 'owns', None), {
+                    'doc': 'The organization owns or owned the target node.'}),
             ),
             'forms': (
                 ('ou:jobtype', {}, ()),
@@ -351,21 +399,24 @@ class OuModule(s_module.CoreModule):
                     }),
                 )),
                 ('ou:id:number', {}, (
+
                     ('type', ('ou:id:type', {}), {
-                        'doc': 'The type of org id', 'ro': True,
-                    }),
+                        'doc': 'The type of org id', 'ro': True}),
+
                     ('value', ('ou:id:value', {}), {
-                        'doc': 'The value of org id', 'ro': True,
-                    }),
+                        'doc': 'The value of org id', 'ro': True}),
+
                     ('status', ('str', {'lower': True, 'strip': True}), {
-                        'doc': 'A freeform status such as valid, suspended, expired.',
-                    }),
+                        'doc': 'A freeform status such as valid, suspended, expired.'}),
+
                     ('issued', ('time', {}), {
-                        'doc': 'The time at which the org issued the ID number.',
-                    }),
+                        'doc': 'The time at which the org issued the ID number.'}),
+
                     ('expires', ('time', {}), {
-                        'doc': 'The time at which the ID number expires.',
-                    }),
+                        'doc': 'The time at which the ID number expires.'}),
+
+                    ('issuer', ('ps:contact', {}), {
+                        'doc': 'The contact information of the office which issued the ID number.'}),
                 )),
                 ('ou:id:update', {}, (
                     ('number', ('ou:id:number', {}), {
@@ -508,7 +559,7 @@ class OuModule(s_module.CoreModule):
                         'doc': 'The tag used to annotate nodes that are associated with the campaign.'}),
 
                     ('mitre:attack:campaign', ('it:mitre:attack:campaign', {}), {
-                        'doc': 'A mapping to a Mitre ATT&CK campaign if applicable.'}),
+                        'doc': 'A mapping to a MITRE ATT&CK campaign if applicable.'}),
                 )),
                 ('ou:conflict', {}, (
                     ('name', ('str', {'onespace': True}), {
@@ -555,7 +606,7 @@ class OuModule(s_module.CoreModule):
                     ('tag', ('syn:tag', {}), {
                         'doc': 'The tag used to annotate nodes where the technique was employed.'}),
                     ('mitre:attack:technique', ('it:mitre:attack:technique', {}), {
-                        'doc': 'A mapping to a Mitre ATT&CK technique if applicable.'}),
+                        'doc': 'A mapping to a MITRE ATT&CK technique if applicable.'}),
                     ('reporter', ('ou:org', {}), {
                         'doc': 'The organization reporting on the technique.'}),
                     ('reporter:name', ('ou:name', {}), {
@@ -714,7 +765,7 @@ class OuModule(s_module.CoreModule):
                         'doc': 'The name of the industry.'}),
 
                     ('type', ('ou:industry:type:taxonomy', {}), {
-                        'doc': 'An taxonomy entry for the industry.'}),
+                        'doc': 'A taxonomy entry for the industry.'}),
 
                     ('names', ('array', {'type': 'ou:industryname', 'uniq': True, 'sorted': True}), {
                         'doc': 'An array of alternative names for the industry.'}),

synapse/models/person.py

@@ -39,11 +39,19 @@ class PsModule(s_module.CoreModule):
                 ('ps:persona:has', ('comp', {'fields': (('persona', 'ps:persona'), ('node', 'ndef'))}), {
                     'deprecated': True,
                     'doc': 'A persona owns, controls, or has exclusive use of an object or'
-                           ' resource, potentially during a specific period of time.'
-                }),
+                           ' resource, potentially during a specific period of time.'}),
+
                 ('ps:contact', ('guid', {}), {
                     'doc': 'A GUID for a contact info record.',
-                }),
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'name'}},
+                            {'type': 'prop', 'opts': {'name': 'type'}},
+                            {'type': 'prop', 'opts': {'name': 'orgname'}},
+                            {'type': 'prop', 'opts': {'name': 'email'}},
+                        ),
+                    }}),
+
                 ('ps:contact:type:taxonomy', ('taxonomy', {}), {
                     'interfaces': ('meta:taxonomy',),
                     'doc': 'A taxonomy of contact types.',
@@ -55,18 +63,39 @@ class PsModule(s_module.CoreModule):
                     'doc': "A GUID representing entry in a contact's work history.",
                 }),
                 ('ps:vitals', ('guid', {}), {
-                    'doc': 'Statistics and demographic data about a person or contact.',
-                }),
+                    'doc': 'Statistics and demographic data about a person or contact.'}),
+
                 ('ps:skill', ('guid', {}), {
-                    'doc': 'A specific skill which a person or organization may have.'
-                }),
+                    'doc': 'A specific skill which a person or organization may have.',
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'name'}},
+                            {'type': 'prop', 'opts': {'name': 'type'}},
+                        ),
+                    }}),
+
                 ('ps:skill:type:taxonomy', ('taxonomy', {}), {
                     'interfaces': ('meta:taxonomy',),
-                    'doc': 'A taxonomy of skill types.',
-                }),
+                    'doc': 'A taxonomy of skill types.'}),
+
                 ('ps:proficiency', ('guid', {}), {
-                    'doc': 'The assessment that a given contact possesses a specific skill.'
-                }),
+                    'doc': 'The assessment that a given contact possesses a specific skill.',
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'contact::name'}},
+                            {'type': 'prop', 'opts': {'name': 'skill::name'}},
+                        ),
+                    }}),
+            ),
+            'edges': (
+                (('ps:contact', 'has', None), {
+                    'doc': 'The contact is or was in possession of the target node.'}),
+                (('ps:person', 'has', None), {
+                    'doc': 'The person is or was in possession of the target node.'}),
+                (('ps:contact', 'owns', None), {
+                    'doc': 'The contact owns or owned the target node.'}),
+                (('ps:person', 'owns', None), {
+                    'doc': 'The person owns or owned the target node.'}),
             ),
             'forms': (
                 ('ps:workhist', {}, (

synapse/models/risk.py

@@ -60,10 +60,22 @@ class RiskModule(s_module.CoreModule):
                     'doc': 'A contiguous range of software versions which contain a vulnerability.'}),
 
                 ('risk:hasvuln', ('guid', {}), {
-                    'doc': 'An instance of a vulnerability present in a target.',
-                }),
+                    'deprecated': True,
+                    'doc': 'Deprecated. Please use risk:vulnerable.'}),
+
+                ('risk:vulnerable', ('guid', {}), {
+                    'doc': 'Indicates that a node is susceptible to a vulnerability.'}),
+
                 ('risk:threat', ('guid', {}), {
                     'doc': 'A threat cluster or subgraph of threat activity, as reported by a specific organization.',
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'org:name'}},
+                            {'type': 'prop', 'opts': {'name': 'org:names'}},
+                            {'type': 'prop', 'opts': {'name': 'reporter:name'}},
+                            {'type': 'prop', 'opts': {'name': 'tag'}},
+                        ),
+                    },
                 }),
                 ('risk:attack', ('guid', {}), {
                     'doc': 'An instance of an actor attacking a target.',
@@ -77,9 +89,22 @@ class RiskModule(s_module.CoreModule):
                 }),
                 ('risk:compromise', ('guid', {}), {
                     'doc': 'An instance of a compromise and its aggregate impact.',
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'name'}},
+                            {'type': 'prop', 'opts': {'name': 'reporter:name'}},
+                        ),
+                    },
                 }),
                 ('risk:mitigation', ('guid', {}), {
                     'doc': 'A mitigation for a specific risk:vuln.',
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'name'}},
+                            {'type': 'prop', 'opts': {'name': 'reporter:name'}},
+                            {'type': 'prop', 'opts': {'name': 'tag'}},
+                        ),
+                    },
                 }),
                 ('risk:attacktype', ('taxonomy', {}), {
                     'doc': 'A taxonomy of attack types.',
@@ -100,6 +125,14 @@ class RiskModule(s_module.CoreModule):
                 }),
                 ('risk:tool:software', ('guid', {}), {
                     'doc': 'A software tool used in threat activity, as reported by a specific organization.',
+                    'display': {
+                        'columns': (
+                            {'type': 'prop', 'opts': {'name': 'soft:name'}},
+                            {'type': 'prop', 'opts': {'name': 'soft:names'}},
+                            {'type': 'prop', 'opts': {'name': 'reporter:name'}},
+                            {'type': 'prop', 'opts': {'name': 'tag'}},
+                        ),
+                    },
                 }),
 
                 ('risk:alert:verdict:taxonomy', ('taxonomy', {}), {
@@ -124,19 +157,22 @@ class RiskModule(s_module.CoreModule):
                 ('risk:extortion:type:taxonomy', ('taxonomy', {}), {
                     'interfaces': ('meta:taxonomy',),
                     'doc': 'A taxonomy of extortion event types.'}),
+
                 ('risk:technique:masquerade', ('guid', {}), {
                     'doc': 'Represents the assessment that a node is designed to resemble another in order to mislead.'}),
             ),
             'edges': (
                 # some explicit examples...
                 (('risk:attack', 'uses', 'ou:technique'), {
-                    'doc': 'The attackers used the technique in the attack.'}),
+                    'doc': 'The attacker used the technique in the attack.'}),
                 (('risk:threat', 'uses', 'ou:technique'), {
                     'doc': 'The threat cluster uses the technique.'}),
                 (('risk:tool:software', 'uses', 'ou:technique'), {
                     'doc': 'The tool uses the technique.'}),
                 (('risk:compromise', 'uses', 'ou:technique'), {
-                    'doc': 'The attackers used the technique in the compromise.'}),
+                    'doc': 'The attacker used the technique in the compromise.'}),
+                (('risk:extortion', 'uses', 'ou:technique'), {
+                    'doc': 'The attacker used the technique to extort the victim.'}),
 
                 (('risk:attack', 'uses', 'risk:vuln'), {
                     'doc': 'The attack used the vulnerability.'}),
@@ -239,6 +275,9 @@ class RiskModule(s_module.CoreModule):
 
                     ('merged:isnow', ('risk:threat', {}), {
                         'doc': 'The threat cluster that the reporting organization merged this cluster into.'}),
+
+                    ('mitre:attack:group', ('it:mitre:attack:group', {}), {
+                        'doc': 'A mapping to a MITRE ATT&CK group if applicable.'}),
                 )),
                 ('risk:availability', {}, {}),
                 ('risk:tool:software:taxonomy', {}, ()),
@@ -288,13 +327,16 @@ class RiskModule(s_module.CoreModule):
                         'deprecated': True,
                         'doc': 'Deprecated for scalability. Please use -(uses)> ou:technique.'}),
 
+                    ('mitre:attack:software', ('it:mitre:attack:software', {}), {
+                        'doc': 'A mapping to a MITRE ATT&CK software if applicable.'}),
+
                 )),
                 ('risk:mitigation', {}, (
 
                     ('vuln', ('risk:vuln', {}), {
                         'doc': 'The vulnerability that this mitigation addresses.'}),
 
-                    ('name', ('str', {}), {
+                    ('name', ('str', {'lower': True, 'onespace': True}), {
                         'doc': 'A brief name for this risk mitigation.'}),
 
                     ('desc', ('str', {}), {
@@ -313,6 +355,9 @@ class RiskModule(s_module.CoreModule):
                     ('reporter:name', ('ou:name', {}), {
                         'doc': 'The name of the organization reporting on the mitigation.'}),
 
+                    ('mitre:attack:mitigation', ('it:mitre:attack:mitigation', {}), {
+                        'doc': 'A mapping to a MITRE ATT&CK mitigation if applicable.'}),
+
                     ('tag', ('syn:tag', {}), {
                         'doc': 'The tag used to annotate nodes which have the mitigation in place.'}),
                 )),
@@ -580,32 +625,32 @@ class RiskModule(s_module.CoreModule):
 
                 ('risk:hasvuln', {}, (
                     ('vuln', ('risk:vuln', {}), {
-                        'doc': 'The vulnerability present in the target.'
-                    }),
+                        'doc': 'The vulnerability present in the target.'}),
                     ('person', ('ps:person', {}), {
-                        'doc': 'The vulnerable person.',
-                    }),
+                        'doc': 'The vulnerable person.'}),
                     ('org', ('ou:org', {}), {
-                        'doc': 'The vulnerable org.',
-                    }),
+                        'doc': 'The vulnerable org.'}),
                     ('place', ('geo:place', {}), {
-                        'doc': 'The vulnerable place.',
-                    }),
+                        'doc': 'The vulnerable place.'}),
                     ('software', ('it:prod:softver', {}), {
-                        'doc': 'The vulnerable software.',
-                    }),
+                        'doc': 'The vulnerable software.'}),
                     ('hardware', ('it:prod:hardware', {}), {
-                        'doc': 'The vulnerable hardware.',
-                    }),
+                        'doc': 'The vulnerable hardware.'}),
                     ('spec', ('mat:spec', {}), {
-                        'doc': 'The vulnerable material specification.',
-                    }),
+                        'doc': 'The vulnerable material specification.'}),
                     ('item', ('mat:item', {}), {
-                        'doc': 'The vulnerable material item.',
-                    }),
+                        'doc': 'The vulnerable material item.'}),
                     ('host', ('it:host', {}), {
-                        'doc': 'The vulnerable host.'
-                    })
+                        'doc': 'The vulnerable host.'})
+                )),
+
+                ('risk:vulnerable', {}, (
+                    ('vuln', ('risk:vuln', {}), {
+                        'doc': 'The vulnerability that the node is susceptible to.'}),
+                    ('period', ('ival', {}), {
+                        'doc': 'The time window where the node was vulnerable.'}),
+                    ('node', ('ndef', {}), {
+                        'doc': 'The node which is vulnerable.'}),
                 )),
 
                 ('risk:alert:taxonomy', {}, {}),
@@ -923,12 +968,18 @@ class RiskModule(s_module.CoreModule):
                     ('compromise', ('risk:compromise', {}), {
                         'doc': 'The compromise which allowed the leaker access to the information.'}),
 
+                    ('extortion', ('risk:extortion', {}), {
+                        'doc': 'The extortion event which used the threat of the leak as leverage.'}),
+
                     ('public', ('bool', {}), {
                         'doc': 'Set to true if the leaked information was made publicly available.'}),
 
                     ('public:url', ('inet:url', {}), {
                         'doc': 'The URL where the leaked information was made publicly available.'}),
 
+                    ('size:bytes', ('int', {'min': 0}), {
+                        'doc': 'The approximate uncompressed size of the total data leaked.'}),
+
                 )),
 
                 ('risk:extortion:type:taxonomy', {}, ()),
@@ -950,6 +1001,9 @@ class RiskModule(s_module.CoreModule):
                     ('demanded', ('time', {}), {
                         'doc': 'The time that the attacker made their demands.'}),
 
+                    ('deadline', ('time', {}), {
+                        'doc': 'The time that the demand must be met.'}),
+
                     ('goal', ('ou:goal', {}), {
                         'doc': 'The goal of the attacker in extorting the victim.'}),
 
@@ -963,7 +1017,7 @@ class RiskModule(s_module.CoreModule):
                         'doc': 'The extortion target identity.'}),
 
                     ('success', ('bool', {}), {
-                        'doc': 'Set to true if the victim met the attackers demands.'}),
+                        'doc': "Set to true if the victim met the attacker's demands."}),
 
                     ('enacted', ('bool', {}), {
                         'doc': 'Set to true if attacker carried out the threat.'}),