← Back to Documentation Index
Multi-Agent System Ontology
Table of Contents
Classes
AnalysisElement
https://ioc-project.github.io/scope-ontology/mas#AnalysisElement
Abstract base for all analysis-layer computed artefacts. dataProvenance = 'computed'. Not emitted during execution — produced by offline or streaming analysis pipelines.
AnomalyReport
https://ioc-project.github.io/scope-ontology/mas#AnomalyReport
Inlier/outlier classification summary for one analysis layer (text/graph/metric), computed across all sessions in a SemanticGroup. Session/MetricResult membership (outlier or not) is via mas:isAnomalous edges; mas:scores/mas:threshold hold the supporting numeric detail.
CognitionProtocolExecutionReport
https://ioc-project.github.io/scope-ontology/mas#CognitionProtocolExecutionReport
How one Cognition protocol went in one Session: which agents had it and which used it, and the protocol's evaluation metrics, as MetricResults that measure this report. One per Session and protocol.
CognitionProtocolReport
https://ioc-project.github.io/scope-ontology/mas#CognitionProtocolReport
Session-level summary of the Cognition protocols: which were enabled (available to the session's agents) and which were activated (actually used). Lists protocol names, so a new protocol adds an entry rather than new properties. One per Session.
CognitiveFailureReport
https://ioc-project.github.io/scope-ontology/mas#CognitiveFailureReport
A cognitive failure (from the challenges taxonomy, e.g. IR-1 or CC-3) detected in a session: the challenge code, the detector's confidence, and a brief reasoning. Attached to the Session, and to the call where the challenge happened when it applies to one.
ConsistencyReport
https://ioc-project.github.io/scope-ontology/mas#ConsistencyReport
Statistical consistency summary for one analysis layer (text/graph/metric) across all sessions in a SemanticGroup: a mean, range, and confidence interval/indicator over the per-session consistency statistic.
NormalBehaviourReport
https://ioc-project.github.io/scope-ontology/mas#NormalBehaviourReport
Representative/centroid summary of normal behaviour for one analysis layer, computed across all sessions in a SemanticGroup.
SemanticAnalysisReport
https://ioc-project.github.io/scope-ontology/mas#SemanticAnalysisReport
Common parent for analysis reports computed over an entire SemanticGroup (as opposed to a single Session or MetricResult). A report cannot exist without the group it was computed over.
Properties
aboutMetric
https://ioc-project.github.io/scope-ontology/mas#aboutMetric
The Metric this report was computed over. Only present when mas:dataType = 'metric' — textual-output and execution-graph reports leave this unset rather than carrying a metric-specific field they don't need. See mas:AnalysisElementAboutMetricShape below, which enforces that conditional requirement.
Domain: AnalysisElement
Range: Metric
agentsActivated
https://ioc-project.github.io/scope-ontology/mas#agentsActivated
Names of the agents that took part in the protocol: they actually used it.
Domain: CognitionProtocolExecutionReport
Range: string
agentsEnabled
https://ioc-project.github.io/scope-ontology/mas#agentsEnabled
Names of the agents that had the protocol available.
Domain: CognitionProtocolExecutionReport
Range: string
atCall
https://ioc-project.github.io/scope-ontology/mas#atCall
The call (LLM, tool or agent call) where the challenge happened. Absent for challenges that only show at the level of the whole session.
Domain: CognitiveFailureReport
Range: ExecutionElement
centroid
https://ioc-project.github.io/scope-ontology/mas#centroid
Centroid of the group's sessions for this layer — a scalar value, or JSON-encoded if structured.
Domain: NormalBehaviourReport
Range: string
code
https://ioc-project.github.io/scope-ontology/mas#code
Code of the detected challenge in the challenges taxonomy, e.g. 'IR-1', 'DC-4', 'CC-3'.
Domain: CognitiveFailureReport
Range: string
confidence
https://ioc-project.github.io/scope-ontology/mas#confidence
How sure the detector is that the challenge happened: 'low' | 'medium' | 'high'.
Domain: CognitiveFailureReport
Range: string
confidenceIndicator
https://ioc-project.github.io/scope-ontology/mas#confidenceIndicator
Human-readable confidence label for this report, e.g. 'low' | 'medium' | 'high'.
Domain: ConsistencyReport
Range: string
confidenceInterval
https://ioc-project.github.io/scope-ontology/mas#confidenceInterval
JSON-encoded confidence interval dict (e.g. {'lower': .., 'upper': ..}) around the mean.
Domain: ConsistencyReport
Range: string
dataType
https://ioc-project.github.io/scope-ontology/mas#dataType
What kind of data this report was computed over: 'text' | 'graph' | 'metric'. Discriminates whether mas:aboutMetric is populated.
Domain: AnalysisElement
Range: string
enabledEvidence
https://ioc-project.github.io/scope-ontology/mas#enabledEvidence
How we know the protocol was enabled: 'system_prompt' when an agent's prompt lists one of its skills, 'activation' when only a call to it shows it was there.
Domain: CognitionProtocolExecutionReport
Range: string
isAnomalous
https://ioc-project.github.io/scope-ontology/mas#isAnomalous
Links an outlier Session, or an outlier MetricResult to the AnomalyReport that flagged it.
Domain: n88ae075d7d9c4bfc9ce14e6ac9be439bb7
Range: AnomalyReport
mean
https://ioc-project.github.io/scope-ontology/mas#mean
Mean value of the consistency statistic across the group's sessions.
Domain: ConsistencyReport
Range: decimal
metricCount
https://ioc-project.github.io/scope-ontology/mas#metricCount
Number of MetricResults currently measuring this report, from the protocol's latest evaluation.
Domain: CognitionProtocolExecutionReport
Range: integer
ofSemanticGroup
https://ioc-project.github.io/scope-ontology/mas#ofSemanticGroup
The SemanticGroup this report was computed over. A SemanticAnalysisReport cannot exist without one; a SemanticGroup does not require any reports.
Domain: SemanticAnalysisReport
Range: SemanticGroup
protocol
https://ioc-project.github.io/scope-ontology/mas#protocol
Name of the Cognition protocol this report is about, for example 'accord'.
Domain: CognitionProtocolExecutionReport
Range: string
protocolsActivated
https://ioc-project.github.io/scope-ontology/mas#protocolsActivated
Names of the Cognition protocols that were activated: an agent actually used them (for example, called one of their skills).
Domain: CognitionProtocolReport
Range: string
protocolsEnabled
https://ioc-project.github.io/scope-ontology/mas#protocolsEnabled
Names of the Cognition protocols that were enabled: available to at least one agent of the session (for example, listed among its skills).
Domain: CognitionProtocolReport
Range: string
rawResult
https://ioc-project.github.io/scope-ontology/mas#rawResult
JSON-encoded raw result dict produced by the normal-behaviour detector (layer-specific shape).
Domain: NormalBehaviourReport
Range: string
reportedAt
https://ioc-project.github.io/scope-ontology/mas#reportedAt
When this report was last written.
Domain: n88ae075d7d9c4bfc9ce14e6ac9be439bb14
Range: dateTime
reportsOn
https://ioc-project.github.io/scope-ontology/mas#reportsOn
The Session this session-level report (Cognition protocol or cognitive failure) describes. A report cannot exist without one.
Domain: n88ae075d7d9c4bfc9ce14e6ac9be439bb10
Range: Session
representativeProcessedSample
https://ioc-project.github.io/scope-ontology/mas#representativeProcessedSample
Processed/normalised form of the representative sample, if the detector produced one.
Domain: NormalBehaviourReport
Range: string
representativeSample
https://ioc-project.github.io/scope-ontology/mas#representativeSample
Identifier (or JSON-encoded value) of the session/sample closest to the centroid — the group's representative example.
Domain: NormalBehaviourReport
Range: string
scores
https://ioc-project.github.io/scope-ontology/mas#scores
JSON-encoded list of raw per-session anomaly scores backing the inlier/outlier classification.
Domain: AnomalyReport
Range: string
skillsActivated
https://ioc-project.github.io/scope-ontology/mas#skillsActivated
Names of the protocol's skills that agents actually called.
Domain: CognitionProtocolExecutionReport
Range: string
skillsEnabled
https://ioc-project.github.io/scope-ontology/mas#skillsEnabled
Names of the protocol's skills that were available to the session's agents.
Domain: CognitionProtocolExecutionReport
Range: string
threshold
https://ioc-project.github.io/scope-ontology/mas#threshold
Score threshold above which a session was classified as an outlier.
Domain: AnomalyReport
Range: decimal
← Back to Documentation Index