CASE/UCO 1.5.0 Release on 24 June 2026

[Eoghan Casey]

DFRWS Community,

We are pleased to announce the release of version 1.5.0 of CASE/UCO open source ontology:

+ CASE (Cyber-investigation Analysis Standard Expression) 1.5.0

+ UCO (Unified Cyber Ontology) 1.5.0 

The centerpiece of UCO 1.5.0 is Technique, UCO’s first meta-class, which bridges general-to-specific actions in cyber-investigations and enables one knowledge base to refine another (e.g., SOLVE-IT and MITRE ATT&CK) with subclassing. Detailed description of Technique and practical applications are covered in this DFRWS.org blog post, and worked examples are in the UCO 1.5.0 Technique tests.

A public meeting is scheduled for August 26 at 10am U.S. Eastern. If you want to participate contact Eoghan Casey (eoghan...@cyberdomainontology.org).

Growing Adoption

Community adoption continues to expand internationally across government agencies, businesses, and universities. In addition to SOLVE-IT’s alignment with CASE, Project VIC has developed a comprehensive semantic framework for modeling child exploitation investigations, operations, legal process, and digital forensics that extends CASE/UCO, aligning its schemas and APIs with these open standards.

What’s Next

Change proposals are open for comment, including:

• Hypothesis, and EvidenceEvaluationResult (CASE Issue 190),

• KeywordSearchResults (CASE Issue 179)

• Capabilities class (UCO Issue 682)

• ActionLifecycle to support non-linear and semi-ordering (UCO Issue 678)

Work is under way on a multi-language SDK (Python, C#, Java, Rust) for building validated CASE/UCO JSON-LD graphs, including MCP server support to make CASE/UCO readily usable by AI agents.

Version 2.0 of CASE/UCO is in the works, which includes deprecating the duck typing model (Facets) in favor of an object-oriented model with properties directly on ObservableObjects.

Please join the public meeting on August 26 to learn more about these developments.

Eoghan Casey

Cyber Domain Ontology