Behavior schema documentation
The six dimensions and a representative record shape.
Research / Open artifacts
The schema, the specimen, the mapping, the code.
What is available now, where it lives, and what is planned.
ArtifactFormatStatusAccess
Technical referenceAvailableOpen artifact
Plain-language dimension mapping
The research notation translated into the questions an analyst asks.
Behavior specimen
A persistence record with evidence and a declared telemetry gap.
ATT&CK representation mapping
The ATT&CK representation mapping has not been released yet.
Reference implementation
Typed FACE-EO model, materialization procedure, baseline parsers, evaluation modules and the curated 12-scenario challenge suite. The DARPA TC E3 trace is not included.
How to read the schema
Begin with meaning, then inspect shape.
- Read the six questions as independent record concerns.
- Inspect which values are observed and which are inferred.
- Follow identifiers back to supporting evidence where available.
- Read the telemetry gap before forming a negative conclusion.
Source code and licensing
The FACE-EO reference implementation is public on GitHub under the MIT licence. Schema references are on this site. The ATT&CK mapping, a versioned release process and a contribution process will be announced here when they are released.
Versioning
Changes need identity and consequence.
Future artifacts should carry a version, publication date, license and change note. Schema changes should state whether they break an existing record or only extend it. Until a changelog route exists, the current references are foundation documents rather than a versioned public release.