@useatlas/create 0.0.5 → 0.0.7

package/templates/nextjs-standalone/data/cybersec-semantic/entities/plans.yml

@@ -0,0 +1,114 @@
+name: Plans
+type: dimension_table
+table: plans
+grain: one row per subscription plan
+description: |
+  Available subscription plans for Sentinel Security. Each plan defines
+  pricing (in cents), asset limits, user limits, and a feature set.
+  Plans are referenced by subscriptions. Use this table for plan comparison,
+  pricing analysis, and capacity planning. The features column stores a
+  text description of included features.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique plan identifier
+    primary_key: true
+
+  - name: name
+    sql: name
+    type: string
+    description: Internal plan name (machine-readable)
+    sample_values: [starter, professional, enterprise, custom]
+
+  - name: display_name
+    sql: display_name
+    type: string
+    description: User-facing plan name
+    sample_values: [Starter, Professional, Enterprise, Custom]
+
+  - name: price_cents
+    sql: price_cents
+    type: number
+    description: Monthly price in cents (divide by 100 for dollars)
+
+  - name: max_assets
+    sql: max_assets
+    type: number
+    description: Maximum number of assets allowed under this plan
+
+  - name: max_users
+    sql: max_users
+    type: number
+    description: Maximum number of users allowed under this plan
+
+  - name: features
+    sql: features
+    type: string
+    description: Text description of features included in this plan
+
+  - name: is_active
+    sql: is_active
+    type: boolean
+    description: Whether this plan is currently available for new subscriptions
+
+  - name: price_dollars
+    sql: price_cents / 100.0
+    type: number
+    description: Monthly price in dollars
+    virtual: true
+
+  - name: price_tier
+    sql: |-
+      CASE
+        WHEN price_cents < 10000 THEN 'Low'
+        WHEN price_cents < 50000 THEN 'Mid'
+        ELSE 'High'
+      END
+    type: string
+    description: Price tier grouping (Low < $100, Mid $100-$500, High $500+)
+    virtual: true
+    sample_values: [Low, Mid, High]
+
+measures:
+  - name: plan_count
+    sql: id
+    type: count_distinct
+    description: Number of unique plans
+
+  - name: avg_price_cents
+    sql: price_cents
+    type: avg
+    description: Average plan price in cents
+
+use_cases:
+  - Plan pricing comparison and tier analysis
+  - Capacity planning based on asset and user limits
+  - Feature comparison across tiers
+  - Active plan availability check
+  - Join to subscriptions for revenue attribution by plan
+
+query_patterns:
+  - name: plan_overview
+    description: All plans with pricing and limits
+    sql: |-
+      SELECT display_name,
+             price_cents / 100.0 AS price_dollars,
+             max_assets,
+             max_users,
+             is_active
+      FROM plans
+      ORDER BY price_cents
+
+  - name: active_plans
+    description: Currently available plans
+    sql: |-
+      SELECT display_name,
+             price_cents / 100.0 AS price_dollars,
+             max_assets,
+             max_users,
+             features
+      FROM plans
+      WHERE is_active = true
+      ORDER BY price_cents

package/templates/nextjs-standalone/data/cybersec-semantic/entities/remediation_actions.yml

@@ -0,0 +1,212 @@
+name: Remediation Actions
+type: fact_table
+table: remediation_actions
+grain: one row per remediation action
+description: |
+  Remediation tasks assigned to address vulnerability instances. Each action
+  has a priority, assignment, due date, and completion tracking. Linked to
+  vulnerability_instances via vulnerability_instance_id. Use for remediation
+  backlog analysis, SLA compliance tracking, workload distribution, and
+  burndown metrics.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique remediation action identifier
+    primary_key: true
+
+  - name: vulnerability_instance_id
+    sql: vulnerability_instance_id
+    type: number
+    description: Foreign key to vulnerability_instances — which specific finding this remediates
+
+  - name: assigned_to
+    sql: assigned_to
+    type: number
+    description: Foreign key to users — who is responsible for this remediation (may be NULL)
+
+  - name: status
+    sql: status
+    type: string
+    description: Current remediation action status
+    sample_values: [open, in_progress, completed, deferred]
+
+  - name: priority
+    sql: priority
+    type: string
+    description: Remediation priority level
+    sample_values: [critical, high, medium, low]
+
+  - name: due_date
+    sql: due_date
+    type: date
+    description: Target completion date for this remediation
+
+  - name: completed_at
+    sql: completed_at
+    type: timestamp
+    description: When the remediation was completed (NULL if not yet done)
+
+  - name: created_at
+    sql: created_at
+    type: timestamp
+    description: When the remediation action was created
+
+  - name: updated_at
+    sql: updated_at
+    type: timestamp
+    description: Last time the remediation action was modified
+
+  - name: priority_rank
+    sql: |-
+      CASE priority
+        WHEN 'critical' THEN 1
+        WHEN 'high' THEN 2
+        WHEN 'medium' THEN 3
+        WHEN 'low' THEN 4
+        ELSE 5
+      END
+    type: number
+    description: Numeric priority rank for sorting (1 = most urgent)
+    virtual: true
+
+  - name: is_overdue
+    sql: |-
+      CASE
+        WHEN status NOT IN ('completed', 'deferred') AND due_date < CURRENT_DATE
+        THEN true
+        ELSE false
+      END
+    type: boolean
+    description: Whether the remediation is past its due date and not completed
+    virtual: true
+
+  - name: is_completed
+    sql: CASE WHEN status = 'completed' THEN true ELSE false END
+    type: boolean
+    description: Whether the remediation has been completed
+    virtual: true
+
+  - name: is_assigned
+    sql: CASE WHEN assigned_to IS NOT NULL THEN true ELSE false END
+    type: boolean
+    description: Whether the remediation has been assigned to someone
+    virtual: true
+
+  - name: completion_days
+    sql: |-
+      CASE
+        WHEN completed_at IS NOT NULL
+        THEN EXTRACT(DAY FROM (completed_at - created_at))
+      END
+    type: number
+    description: Days between creation and completion (NULL if not completed)
+    virtual: true
+
+  - name: days_until_due
+    sql: |-
+      CASE
+        WHEN due_date IS NOT NULL AND status NOT IN ('completed', 'deferred')
+        THEN due_date - CURRENT_DATE
+      END
+    type: number
+    description: Days until due date (negative = overdue). NULL if completed or no due date
+    virtual: true
+
+  - name: created_month
+    sql: TO_CHAR(created_at, 'YYYY-MM')
+    type: string
+    description: Year-month the remediation was created
+    virtual: true
+
+  - name: sla_status
+    sql: |-
+      CASE
+        WHEN status IN ('completed', 'deferred') THEN 'Done'
+        WHEN due_date IS NULL THEN 'No SLA'
+        WHEN due_date >= CURRENT_DATE THEN 'On Track'
+        ELSE 'Overdue'
+      END
+    type: string
+    description: SLA compliance status
+    virtual: true
+    sample_values: [Done, No SLA, On Track, Overdue]
+
+measures:
+  - name: action_count
+    sql: id
+    type: count_distinct
+    description: Number of unique remediation actions
+
+  - name: open_action_count
+    sql: CASE WHEN status IN ('open', 'in_progress') THEN id END
+    type: count_distinct
+    description: Number of open or in-progress remediation actions
+
+  - name: overdue_count
+    sql: CASE WHEN status NOT IN ('completed', 'deferred') AND due_date < CURRENT_DATE THEN id END
+    type: count_distinct
+    description: Number of overdue remediation actions
+
+  - name: avg_completion_days
+    sql: CASE WHEN completed_at IS NOT NULL THEN EXTRACT(DAY FROM (completed_at - created_at)) END
+    type: avg
+    description: Average days to complete a remediation action
+
+joins:
+  - target_entity: Users
+    relationship: many_to_one
+    join_columns:
+      from: assigned_to
+      to: id
+    description: Each remediation may be assigned to one user
+
+use_cases:
+  - Remediation backlog size and burndown analysis
+  - SLA compliance — overdue actions by priority
+  - Assignment workload distribution across team members
+  - Completion rate by priority level
+  - Average remediation time trending
+
+query_patterns:
+  - name: remediation_by_priority
+    description: Remediation count and completion rate by priority
+    sql: |-
+      SELECT priority,
+             COUNT(*) AS total,
+             COUNT(*) FILTER (WHERE status = 'completed') AS completed,
+             COUNT(*) FILTER (WHERE status NOT IN ('completed', 'deferred')
+                              AND due_date < CURRENT_DATE) AS overdue,
+             AVG(EXTRACT(DAY FROM (completed_at - created_at)))
+               FILTER (WHERE completed_at IS NOT NULL) AS avg_completion_days
+      FROM remediation_actions
+      GROUP BY priority
+      ORDER BY MIN(CASE priority
+        WHEN 'critical' THEN 1 WHEN 'high' THEN 2
+        WHEN 'medium' THEN 3 WHEN 'low' THEN 4 ELSE 5 END)
+
+  - name: remediation_by_assignee
+    description: Workload per assigned user
+    sql: |-
+      SELECT u.full_name AS assignee,
+             COUNT(r.id) AS total_actions,
+             COUNT(*) FILTER (WHERE r.status IN ('open', 'in_progress')) AS open_actions,
+             COUNT(*) FILTER (WHERE r.status NOT IN ('completed', 'deferred')
+                              AND r.due_date < CURRENT_DATE) AS overdue
+      FROM remediation_actions r
+      JOIN users u ON r.assigned_to = u.id
+      GROUP BY u.full_name
+      ORDER BY open_actions DESC
+
+  - name: overdue_remediations
+    description: All overdue remediation actions
+    sql: |-
+      SELECT r.id, r.priority, r.status, r.due_date,
+             r.due_date - CURRENT_DATE AS days_overdue,
+             u.full_name AS assignee
+      FROM remediation_actions r
+      LEFT JOIN users u ON r.assigned_to = u.id
+      WHERE r.status NOT IN ('completed', 'deferred')
+        AND r.due_date < CURRENT_DATE
+      ORDER BY r.due_date

package/templates/nextjs-standalone/data/cybersec-semantic/entities/scan_results.yml

@@ -0,0 +1,215 @@
+name: Scan Results
+type: fact_table
+table: scan_results
+grain: one row per vulnerability finding in a scan
+description: |
+  Individual findings from vulnerability scans. Each row represents a specific
+  vulnerability found on a specific asset during a specific scan. Contains
+  risk_level (1–10), status, details, and timestamps for discovery and
+  resolution. Note: scan_id, asset_id, and vulnerability_id columns do NOT
+  have formal foreign key constraints — joins must handle potential orphans.
+  This is the primary table for vulnerability exposure analysis, MTTR
+  calculations, and risk trending.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique scan result (finding) identifier
+    primary_key: true
+
+  - name: scan_id
+    sql: scan_id
+    type: number
+    description: |
+      Reference to the scan that produced this finding. No formal FK constraint —
+      some scan_ids may not match scans.id.
+
+  - name: asset_id
+    sql: asset_id
+    type: number
+    description: |
+      Reference to the asset where the vulnerability was found. No formal FK
+      constraint — some asset_ids may not match assets.id.
+
+  - name: vulnerability_id
+    sql: vulnerability_id
+    type: number
+    description: |
+      Reference to the vulnerability (CVE) that was detected. No formal FK
+      constraint — some vulnerability_ids may not match vulnerabilities.id.
+
+  - name: risk_level
+    sql: risk_level
+    type: number
+    description: |
+      Contextual risk score (1–10) for this specific finding. Accounts for
+      asset context, environment, and vulnerability severity. Higher = more critical.
+      Distinct from CVSS (which rates the vulnerability generically).
+
+  - name: status
+    sql: status
+    type: string
+    description: Current finding status
+    sample_values: [open, resolved, false_positive, accepted_risk]
+
+  - name: details
+    sql: details
+    type: string
+    description: Additional details about the finding (free text)
+
+  - name: found_at
+    sql: found_at
+    type: timestamp
+    description: When the vulnerability was first discovered on this asset
+
+  - name: resolved_at
+    sql: resolved_at
+    type: timestamp
+    description: When the finding was resolved (NULL if still open)
+
+  - name: risk_tier
+    sql: |-
+      CASE
+        WHEN risk_level >= 9 THEN 'Critical (9-10)'
+        WHEN risk_level >= 7 THEN 'High (7-8)'
+        WHEN risk_level >= 4 THEN 'Medium (4-6)'
+        ELSE 'Low (1-3)'
+      END
+    type: string
+    description: Risk level tier bucket
+    virtual: true
+    sample_values: [Critical (9-10), High (7-8), Medium (4-6), Low (1-3)]
+
+  - name: is_open
+    sql: CASE WHEN status = 'open' THEN true ELSE false END
+    type: boolean
+    description: Whether this finding is currently open (unresolved)
+    virtual: true
+
+  - name: is_resolved
+    sql: CASE WHEN status = 'resolved' THEN true ELSE false END
+    type: boolean
+    description: Whether this finding has been resolved
+    virtual: true
+
+  - name: resolution_days
+    sql: |-
+      CASE
+        WHEN resolved_at IS NOT NULL
+        THEN EXTRACT(DAY FROM (resolved_at - found_at))
+      END
+    type: number
+    description: Days between discovery and resolution (NULL if still open)
+    virtual: true
+
+  - name: found_date
+    sql: found_at::DATE
+    type: date
+    description: Date the finding was discovered (for daily grouping)
+    virtual: true
+
+  - name: found_month
+    sql: TO_CHAR(found_at, 'YYYY-MM')
+    type: string
+    description: Year-month the finding was discovered
+    virtual: true
+
+  - name: age_days
+    sql: EXTRACT(DAY FROM (CURRENT_TIMESTAMP - found_at))
+    type: number
+    description: Days since the finding was discovered (age of the finding)
+    virtual: true
+
+measures:
+  - name: finding_count
+    sql: id
+    type: count_distinct
+    description: Number of unique findings
+
+  - name: open_finding_count
+    sql: CASE WHEN status = 'open' THEN id END
+    type: count_distinct
+    description: Number of currently open findings
+
+  - name: resolved_finding_count
+    sql: CASE WHEN status = 'resolved' THEN id END
+    type: count_distinct
+    description: Number of resolved findings
+
+  - name: avg_risk_level
+    sql: risk_level
+    type: avg
+    description: Average risk level across findings
+
+  - name: avg_resolution_days
+    sql: CASE WHEN resolved_at IS NOT NULL THEN EXTRACT(DAY FROM (resolved_at - found_at)) END
+    type: avg
+    description: Average days to resolve a finding (MTTR for findings)
+
+joins:
+  - target_entity: Scans
+    relationship: many_to_one
+    join_columns:
+      from: scan_id
+      to: id
+    description: Each finding comes from one scan (no formal FK — may have orphans)
+
+  - target_entity: Assets
+    relationship: many_to_one
+    join_columns:
+      from: asset_id
+      to: id
+    description: Each finding is on one asset (no formal FK — may have orphans)
+
+  - target_entity: Vulnerabilities
+    relationship: many_to_one
+    join_columns:
+      from: vulnerability_id
+      to: id
+    description: Each finding is of one vulnerability (no formal FK — may have orphans)
+
+use_cases:
+  - Open vulnerability exposure analysis across the fleet
+  - Mean time to remediation (MTTR) calculation and trending
+  - Risk level distribution and prioritization
+  - Per-asset and per-organization vulnerability density
+  - Remediation progress tracking (open vs resolved over time)
+
+query_patterns:
+  - name: findings_by_status
+    description: Finding count by status
+    sql: |-
+      SELECT status,
+             COUNT(*) AS finding_count,
+             AVG(risk_level) AS avg_risk
+      FROM scan_results
+      GROUP BY status
+      ORDER BY finding_count DESC
+
+  - name: mttr_by_risk_tier
+    description: Mean time to resolve by risk tier
+    sql: |-
+      SELECT CASE
+               WHEN risk_level >= 9 THEN 'Critical (9-10)'
+               WHEN risk_level >= 7 THEN 'High (7-8)'
+               WHEN risk_level >= 4 THEN 'Medium (4-6)'
+               ELSE 'Low (1-3)'
+             END AS risk_tier,
+             COUNT(*) AS finding_count,
+             AVG(EXTRACT(DAY FROM (resolved_at - found_at))) AS avg_resolution_days
+      FROM scan_results
+      WHERE resolved_at IS NOT NULL
+      GROUP BY risk_tier
+      ORDER BY MIN(risk_level) DESC
+
+  - name: open_findings_by_month
+    description: Open findings trend by discovery month
+    sql: |-
+      SELECT TO_CHAR(found_at, 'YYYY-MM') AS found_month,
+             COUNT(*) AS total_found,
+             COUNT(*) FILTER (WHERE status = 'open') AS still_open,
+             COUNT(*) FILTER (WHERE status = 'resolved') AS resolved
+      FROM scan_results
+      GROUP BY found_month
+      ORDER BY found_month