Axis proposals awaiting a ruling
Classifications the machine was not confident enough to write. Accept the proposal, choose a different value, or leave the axis unset. Each ruling writes one row and records what was proposed next to what you chose.
canonical_form "open-source software" matches /\b(application|software)$/i (r:ne.asset.application.v1)
canonical_form "system-level software" matches /\b(application|software)$/i (r:ne.asset.application.v1)
canonical_form "solid-state device" matches /\b(device|devices)$/i (r:ne.asset.device.v1)
canonical_form "user training" matches /\b(training|assessment|review|audit)$/i (r:ne.task.exercise.v1)
canonical_form "user identity" matches /\b(user\s+account|service\s+account|user\s+identity|principal|subject|persona)\b/i (r:entity.identity.account.v1)
canonical_form "types of external system" matches /^(?!.*\b(committee|council|forum|bureau|association|agency)\b)(?!.*\bscoring\s+system(s)?$).*\b(system|systems)$/i (r:ne.asset.system.v2)
canonical_form "part of collaborative computing device" matches /\b(device|devices)$/i (r:ne.asset.device.v1)
canonical_form "development system" matches /^(?!.*\b(committee|council|forum|bureau|association|agency)\b)(?!.*\bscoring\s+system(s)?$).*\b(system|systems)$/i (r:ne.asset.system.v2)
canonical_form "human component" matches /\b(component|components)$/i (r:ne.asset_component.component.v1)
canonical_form "accessible system" matches /^(?!.*\b(committee|council|forum|bureau|association|agency)\b)(?!.*\bscoring\s+system(s)?$).*\b(system|systems)$/i (r:ne.asset.system.v2)
canonical_form "required security control" matches /^(?!.*\bmedia\s+access\s+control\b).*\b(security\s+control|safeguard|countermeasure|mitigation|access\s+control)\b/i (r:entity.control.safeguard.v2)
canonical_form "contractors operating system" matches /\b(server|workstation|endpoint|hypervisor|virtual\s+machine|container|kubernetes\s+cluster|operating\s+system|kernel|hardware|appliance)\b/i (r:entity.system.compute.v1)
canonical_form "violation of organizational policy" matches /^(?!.*\b(federal|state|government[- ]?wide|national|nara|omb|nist|dod|dhs|cisa|gsa|opm|presidential|congressional)\b).*\b(polic(y|ies)|procedures?|checklists?|sops?)$/i (r:ne.compliance_doc.policy_procedure.v1)
canonical_form "types of audit log" matches /\b(audit\s+log|access\s+log|event\s+log|system\s+log|incident\s+report|audit\s+report|inventory\s+list|asset\s+inventory)\b/i (r:entity.artifact.log.v1)
canonical_form "type of access agreement" matches /\b(agreement|contract)$/i (r:ne.record.agreement.v1)
canonical_form "notification of organizational personnel" matches /\b(security\s+incident|security\s+event|breach\s+event|alert|alarm|notification|detection\s+event)\b/i (r:entity.event.incident.v1)
canonical_form "insider threat awareness topic" matches /\b(threat\s+actor|adversary|attacker|insider\s+threat|nation[\s-]?state)\b/i (r:entity.threat.actor.v1)
canonical_form "applicable access control policy" matches /^(?!.*\b(federal|state|government[- ]?wide|national|nara|omb|nist|dod|dhs|cisa|gsa|opm|presidential|congressional)\b).*\b(polic(y|ies)|procedures?|checklists?|sops?)$/i (r:ne.compliance_doc.policy_procedure.v1)
canonical_form "transmission capabilities of mobile device" matches /\b(device|devices)$/i (r:ne.asset.device.v1)
canonical_form "potential indicators of insider threat" matches /\b(threat\s+actor|adversary|attacker|insider\s+threat|nation[\s-]?state)\b/i (r:entity.threat.actor.v1)
canonical_form "effectiveness of incident response process" matches /^(?!.*\b(team|teams|forum|committee)\b).*\b(risk\s+assessment|incident\s+response|change\s+management|configuration\s+management|patch\s+management|backup\s+procedure|disaster\s+recovery)\b/i (r:entity.process.w
canonical_form "effective accountability of system component" matches /\b(component|components)$/i (r:ne.asset_component.component.v1)
canonical_form "resilient system" matches /^(?!.*\b(committee|council|forum|bureau|association|agency)\b)(?!.*\bscoring\s+system(s)?$).*\b(system|systems)$/i (r:ne.asset.system.v2)
canonical_form "owned system" matches /^(?!.*\b(committee|council|forum|bureau|association|agency)\b)(?!.*\bscoring\s+system(s)?$).*\b(system|systems)$/i (r:ne.asset.system.v2)
canonical_form "types of agreement" matches /\b(agreement|contract)$/i (r:ne.record.agreement.v1)
canonical_form "sensor device" matches /\b(device|devices)$/i (r:ne.asset.device.v1)
canonical_form "technical control device" matches /\b(device|devices)$/i (r:ne.asset.device.v1)
canonical_form "physical device" matches /\b(device|devices)$/i (r:ne.asset.device.v1)
canonical_form "interconnected component" matches /\b(component|components)$/i (r:ne.asset_component.component.v1)
canonical_form "sources of system security alert" matches /\b(security\s+incident|security\s+event|breach\s+event|alert|alarm|notification|detection\s+event)\b/i (r:entity.event.incident.v1)
canonical_form "operations personnel" matches /^(?!.*\bresponse\s+team(s)?$).*\b(team|committee|personnel|staff|workforce|board|boards|users)$/i (r:ne.group.team.v3)
canonical_form "security procedure" matches /^(?!.*\b(federal|state|government[- ]?wide|national|nara|omb|nist|dod|dhs|cisa|gsa|opm|presidential|congressional)\b).*\b(polic(y|ies)|procedures?|checklists?|sops?)$/i (r:ne.compliance_doc.policy_procedure.v1)
canonical_form "security capability" matches /\b(security\s+capability|defense[\s-]?in[\s-]?depth|continuous\s+monitoring|threat\s+intelligence|security\s+operations\s+center|soc(?!\s*(\d|®|for\b)))\b/i (r:entity.capability.service.v2)
canonical_form "notebook system" matches /^(?!.*\b(committee|council|forum|bureau|association|agency)\b)(?!.*\bscoring\s+system(s)?$).*\b(system|systems)$/i (r:ne.asset.system.v2)
canonical_form "network appliance" matches /\b(server|workstation|endpoint|hypervisor|virtual\s+machine|container|kubernetes\s+cluster|operating\s+system|kernel|hardware|appliance)\b/i (r:entity.system.compute.v1)
canonical_form "established configuration setting" matches /\bsetting(s)?$/i (r:ne.configurable.setting.v1)
canonical_form "defined configuration setting" matches /\bsetting(s)?$/i (r:ne.configurable.setting.v1)
canonical_form "collection of interconnected component" matches /\b(component|components)$/i (r:ne.asset_component.component.v1)
canonical_form "manual procedure" matches /^(?!.*\b(federal|state|government[- ]?wide|national|nara|omb|nist|dod|dhs|cisa|gsa|opm|presidential|congressional)\b).*\b(polic(y|ies)|procedures?|checklists?|sops?)$/i (r:ne.compliance_doc.policy_procedure.v1)
canonical_form "professional security staff" matches /^(?!.*\bresponse\s+team(s)?$).*\b(team|committee|personnel|staff|workforce|board|boards|users)$/i (r:ne.group.team.v3)
canonical_form "network monitoring software" matches /\b(application|software)$/i (r:ne.asset.application.v1)
canonical_form "known system vulnerability" matches /^((.+\s+)?(vulnerability|cve|cwe)|zero[\s-]?day)$/i (r:entity.vulnerability.cve.v2)
canonical_form "designated web server" matches /\b(server|workstation|endpoint|hypervisor|virtual\s+machine|container|kubernetes\s+cluster|operating\s+system|kernel|hardware|appliance)\b/i (r:entity.system.compute.v1)
canonical_form "critical software component" matches /\b(component|components)$/i (r:ne.asset_component.component.v1)
canonical_form "comprehensive role-based training" matches /\b(training|assessment|review|audit)$/i (r:ne.task.exercise.v1)
canonical_form "content of literacy training" matches /\b(training|assessment|review|audit)$/i (r:ne.task.exercise.v1)
canonical_form "local system" matches /^(?!.*\b(committee|council|forum|bureau|association|agency)\b)(?!.*\bscoring\s+system(s)?$).*\b(system|systems)$/i (r:ne.asset.system.v2)
canonical_form "structure of incident response capability" matches /^(?!.*\b(team|teams|forum|committee)\b).*\b(risk\s+assessment|incident\s+response|change\s+management|configuration\s+management|patch\s+management|backup\s+procedure|disaster\s+recovery)\b/i (r:entity.process.wo
canonical_form "original security control baseline specification" matches /^(?!.*\bmedia\s+access\s+control\b).*\b(security\s+control|safeguard|countermeasure|mitigation|access\s+control)\b/i (r:entity.control.safeguard.v2)
canonical_form "operational procedure" matches /^(?!.*\b(federal|state|government[- ]?wide|national|nara|omb|nist|dod|dhs|cisa|gsa|opm|presidential|congressional)\b).*\b(polic(y|ies)|procedures?|checklists?|sops?)$/i (r:ne.compliance_doc.policy_procedure.v1)