@useatlas/create 0.0.5 → 0.0.7

package/templates/nextjs-standalone/data/cybersec-semantic/entities/scans.yml

@@ -0,0 +1,180 @@
+name: Scans
+type: fact_table
+table: scans
+grain: one row per scan execution
+description: |
+  Vulnerability scan executions on customer organizations. Each scan has a
+  type (full, incremental, compliance), status, timing information, and
+  summary counts (assets_scanned, findings_count). Linked to organizations
+  and optionally to scan_configurations. Scan results (individual findings)
+  are stored in the scan_results table.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique scan identifier
+    primary_key: true
+
+  - name: organization_id
+    sql: organization_id
+    type: number
+    description: Foreign key to organizations — which customer this scan belongs to
+
+  - name: scan_configuration_id
+    sql: scan_configuration_id
+    type: number
+    description: Foreign key to scan_configurations — which config drove this scan
+
+  - name: scan_type
+    sql: scan_type
+    type: string
+    description: Type of scan performed
+    sample_values: [full, incremental, compliance]
+
+  - name: status
+    sql: status
+    type: string
+    description: Current scan execution status
+    sample_values: [pending, running, completed, failed, canceled]
+
+  - name: started_at
+    sql: started_at
+    type: timestamp
+    description: When the scan began executing
+
+  - name: completed_at
+    sql: completed_at
+    type: timestamp
+    description: When the scan finished (NULL if still running or failed)
+
+  - name: assets_scanned
+    sql: assets_scanned
+    type: number
+    description: Number of assets scanned in this execution
+
+  - name: findings_count
+    sql: findings_count
+    type: number
+    description: Number of vulnerability findings produced by this scan
+
+  - name: created_at
+    sql: created_at
+    type: timestamp
+    description: When the scan record was created
+
+  - name: duration_minutes
+    sql: |-
+      CASE
+        WHEN completed_at IS NOT NULL AND started_at IS NOT NULL
+        THEN EXTRACT(EPOCH FROM (completed_at - started_at)) / 60.0
+      END
+    type: number
+    description: Scan duration in minutes (NULL if not completed)
+    virtual: true
+
+  - name: findings_per_asset
+    sql: |-
+      CASE
+        WHEN assets_scanned > 0
+        THEN findings_count::FLOAT / assets_scanned
+      END
+    type: number
+    description: Average findings per asset scanned (vulnerability density)
+    virtual: true
+
+  - name: started_date
+    sql: started_at::DATE
+    type: date
+    description: Date the scan started (for daily grouping)
+    virtual: true
+
+  - name: started_month
+    sql: TO_CHAR(started_at, 'YYYY-MM')
+    type: string
+    description: Year-month the scan started
+    virtual: true
+
+  - name: is_completed
+    sql: CASE WHEN status = 'completed' THEN true ELSE false END
+    type: boolean
+    description: Whether the scan completed successfully
+    virtual: true
+
+measures:
+  - name: scan_count
+    sql: id
+    type: count_distinct
+    description: Number of unique scans
+
+  - name: total_assets_scanned
+    sql: assets_scanned
+    type: sum
+    description: Total assets scanned across all scans
+
+  - name: total_findings
+    sql: findings_count
+    type: sum
+    description: Total findings across all scans
+
+  - name: avg_findings_count
+    sql: findings_count
+    type: avg
+    description: Average findings per scan
+
+  - name: avg_assets_scanned
+    sql: assets_scanned
+    type: avg
+    description: Average assets scanned per scan
+
+joins:
+  - target_entity: Organizations
+    relationship: many_to_one
+    join_columns:
+      from: organization_id
+      to: id
+    description: Each scan belongs to one organization
+
+use_cases:
+  - Scan coverage and frequency analysis by organization
+  - Scan performance tracking (duration, success rate)
+  - Findings trend analysis over scan history
+  - Scan failure rate monitoring and debugging
+  - Vulnerability density trending (findings per asset over time)
+
+query_patterns:
+  - name: scans_by_type
+    description: Scan count and results by type
+    sql: |-
+      SELECT scan_type,
+             COUNT(*) AS scan_count,
+             AVG(assets_scanned) AS avg_assets,
+             AVG(findings_count) AS avg_findings,
+             COUNT(*) FILTER (WHERE status = 'completed') AS completed,
+             COUNT(*) FILTER (WHERE status = 'failed') AS failed
+      FROM scans
+      GROUP BY scan_type
+      ORDER BY scan_count DESC
+
+  - name: scan_frequency_by_org
+    description: Scan frequency per organization (last 30 days)
+    sql: |-
+      SELECT o.name AS organization,
+             COUNT(s.id) AS scan_count,
+             SUM(s.assets_scanned) AS total_assets_scanned,
+             SUM(s.findings_count) AS total_findings
+      FROM scans s
+      JOIN organizations o ON s.organization_id = o.id
+      WHERE s.started_at >= CURRENT_TIMESTAMP - INTERVAL '30 days'
+      GROUP BY o.name
+      ORDER BY scan_count DESC
+
+  - name: scan_success_rate
+    description: Scan completion vs failure rate
+    sql: |-
+      SELECT status,
+             COUNT(*) AS count,
+             ROUND(100.0 * COUNT(*) / SUM(COUNT(*)) OVER (), 1) AS pct
+      FROM scans
+      GROUP BY status
+      ORDER BY count DESC

package/templates/nextjs-standalone/data/cybersec-semantic/entities/subscriptions.yml

@@ -0,0 +1,184 @@
+name: Subscriptions
+type: fact_table
+table: subscriptions
+grain: one row per subscription
+description: |
+  Subscriptions linking organizations to plans. Each subscription tracks
+  billing status, MRR contribution (in cents), billing period, and lifecycle
+  dates. plan_name is denormalized from plans for convenience. This is the
+  core table for revenue analysis, churn tracking, and subscription health.
+  An organization can have one active subscription at a time.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique subscription identifier
+    primary_key: true
+
+  - name: organization_id
+    sql: organization_id
+    type: number
+    description: Foreign key to organizations — which customer owns this subscription
+
+  - name: plan_id
+    sql: plan_id
+    type: number
+    description: Foreign key to plans — which plan this subscription is on
+
+  - name: plan_name
+    sql: plan_name
+    type: string
+    description: Denormalized plan name (from plans table)
+    sample_values: [starter, professional, enterprise, custom]
+
+  - name: status
+    sql: status
+    type: string
+    description: |
+      Current subscription status. active = paying, trialing = in trial period,
+      past_due = payment failed, canceled = churned.
+    sample_values: [active, trialing, past_due, canceled]
+
+  - name: mrr_cents
+    sql: mrr_cents
+    type: number
+    description: |
+      Monthly Recurring Revenue from this subscription in cents. Divide by 100
+      for dollars. Canceled subscriptions may have mrr_cents = 0.
+
+  - name: started_at
+    sql: started_at
+    type: timestamp
+    description: When the subscription began
+
+  - name: current_period_end
+    sql: current_period_end
+    type: timestamp
+    description: End of the current billing period — renewal or expiration date
+
+  - name: created_at
+    sql: created_at
+    type: timestamp
+    description: When the subscription record was created
+
+  - name: updated_at
+    sql: updated_at
+    type: timestamp
+    description: Last time the subscription was modified
+
+  - name: mrr_dollars
+    sql: mrr_cents / 100.0
+    type: number
+    description: Monthly Recurring Revenue in dollars
+    virtual: true
+
+  - name: mrr_bucket
+    sql: |-
+      CASE
+        WHEN mrr_cents = 0 THEN 'Free/Canceled'
+        WHEN mrr_cents < 10000 THEN 'Under $100'
+        WHEN mrr_cents < 50000 THEN '$100-$500'
+        WHEN mrr_cents < 200000 THEN '$500-$2K'
+        ELSE '$2K+'
+      END
+    type: string
+    description: MRR tier bucket for segmentation
+    virtual: true
+    sample_values: [Free/Canceled, Under $100, $100-$500, $500-$2K, $2K+]
+
+  - name: started_year
+    sql: EXTRACT(YEAR FROM started_at)
+    type: number
+    description: Year the subscription started — useful for cohort analysis
+    virtual: true
+
+  - name: started_month
+    sql: TO_CHAR(started_at, 'YYYY-MM')
+    type: string
+    description: Year-month the subscription started
+    virtual: true
+
+  - name: is_churned
+    sql: CASE WHEN status = 'canceled' THEN true ELSE false END
+    type: boolean
+    description: Whether this subscription has been canceled (churned)
+    virtual: true
+
+  - name: days_until_renewal
+    sql: EXTRACT(DAY FROM (current_period_end - CURRENT_TIMESTAMP))
+    type: number
+    description: Days until the current billing period ends
+    virtual: true
+
+measures:
+  - name: subscription_count
+    sql: id
+    type: count_distinct
+    description: Number of unique subscriptions
+
+  - name: total_mrr_cents
+    sql: mrr_cents
+    type: sum
+    description: Total MRR in cents across subscriptions
+
+  - name: avg_mrr_cents
+    sql: mrr_cents
+    type: avg
+    description: Average MRR per subscription in cents
+
+joins:
+  - target_entity: Organizations
+    relationship: many_to_one
+    join_columns:
+      from: organization_id
+      to: id
+    description: Each subscription belongs to one organization
+
+  - target_entity: Plans
+    relationship: many_to_one
+    join_columns:
+      from: plan_id
+      to: id
+    description: Each subscription is on one plan
+
+use_cases:
+  - MRR analysis — total, by plan, by status, over time
+  - Churn analysis — canceled vs active subscriptions, churn rate by plan
+  - Revenue segmentation — which plans drive the most revenue
+  - Subscription lifecycle — cohort analysis, renewal tracking
+  - Cross-entity joins to organizations for firmographic revenue analysis
+
+query_patterns:
+  - name: mrr_by_plan
+    description: Total MRR and subscription count by plan
+    sql: |-
+      SELECT plan_name,
+             SUM(mrr_cents) / 100.0 AS total_mrr_dollars,
+             COUNT(*) AS subscription_count,
+             AVG(mrr_cents) / 100.0 AS avg_mrr_dollars
+      FROM subscriptions
+      WHERE status = 'active'
+      GROUP BY plan_name
+      ORDER BY total_mrr_dollars DESC
+
+  - name: churn_rate_by_plan
+    description: Churn rate by plan type
+    sql: |-
+      SELECT plan_name,
+             COUNT(*) FILTER (WHERE status = 'canceled') AS churned,
+             COUNT(*) AS total,
+             ROUND(100.0 * COUNT(*) FILTER (WHERE status = 'canceled') / COUNT(*), 1) AS churn_pct
+      FROM subscriptions
+      GROUP BY plan_name
+      ORDER BY churn_pct DESC
+
+  - name: subscriptions_by_status
+    description: Subscription distribution by billing status
+    sql: |-
+      SELECT status,
+             COUNT(*) AS count,
+             SUM(mrr_cents) / 100.0 AS total_mrr_dollars
+      FROM subscriptions
+      GROUP BY status
+      ORDER BY count DESC

package/templates/nextjs-standalone/data/cybersec-semantic/entities/users.yml

@@ -0,0 +1,140 @@
+name: Users
+type: dimension_table
+table: users
+grain: one row per user account
+description: |
+  Users within customer organizations on the Sentinel Security platform.
+  Each user belongs to one organization and has a role, email, login history,
+  and active status. The role column is a legacy field (may not reflect current
+  RBAC). last_login is mostly NULL for users who have not yet logged in.
+  organization_name is denormalized from organizations for convenience.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique user identifier
+    primary_key: true
+
+  - name: organization_id
+    sql: organization_id
+    type: number
+    description: Foreign key to organizations — which customer this user belongs to
+
+  - name: organization_name
+    sql: organization_name
+    type: string
+    description: Denormalized organization name (from organizations table)
+
+  - name: email
+    sql: email
+    type: string
+    description: User's email address
+
+  - name: full_name
+    sql: full_name
+    type: string
+    description: User's full name
+
+  - name: role
+    sql: role
+    type: string
+    description: |
+      Legacy role assignment. Values: admin, analyst, viewer, owner.
+      May not reflect current RBAC permissions — use for approximate analysis.
+    sample_values: [admin, analyst, viewer, owner]
+
+  - name: last_login
+    sql: last_login
+    type: timestamp
+    description: |
+      Last login timestamp. Mostly NULL (~80%) for users who have never logged in
+      or whose login was not recorded. Use with caution for engagement analysis.
+
+  - name: created_at
+    sql: created_at
+    type: timestamp
+    description: When the user account was created
+
+  - name: is_active
+    sql: is_active
+    type: boolean
+    description: Whether the user account is currently active
+
+  - name: has_logged_in
+    sql: CASE WHEN last_login IS NOT NULL THEN true ELSE false END
+    type: boolean
+    description: Whether the user has ever logged in to the platform
+    virtual: true
+
+  - name: created_month
+    sql: TO_CHAR(created_at, 'YYYY-MM')
+    type: string
+    description: Year-month the user was created
+    virtual: true
+
+  - name: days_since_login
+    sql: |-
+      CASE
+        WHEN last_login IS NOT NULL
+        THEN EXTRACT(DAY FROM (CURRENT_TIMESTAMP - last_login))
+      END
+    type: number
+    description: Days since last login (NULL if never logged in)
+    virtual: true
+
+measures:
+  - name: user_count
+    sql: id
+    type: count_distinct
+    description: Number of unique users
+
+  - name: active_user_count
+    sql: CASE WHEN is_active THEN id END
+    type: count_distinct
+    description: Number of active users
+
+joins:
+  - target_entity: Organizations
+    relationship: many_to_one
+    join_columns:
+      from: organization_id
+      to: id
+    description: Each user belongs to one organization
+
+use_cases:
+  - User adoption and engagement analysis per organization
+  - Role distribution across the platform
+  - Stale account detection (never logged in, inactive)
+  - User growth trending over time
+  - Join to organizations for user density per customer
+
+query_patterns:
+  - name: users_by_role
+    description: User count by role
+    sql: |-
+      SELECT role,
+             COUNT(*) AS user_count,
+             COUNT(*) FILTER (WHERE is_active) AS active_count
+      FROM users
+      GROUP BY role
+      ORDER BY user_count DESC
+
+  - name: users_per_org
+    description: User density per organization
+    sql: |-
+      SELECT organization_name,
+             COUNT(*) AS user_count,
+             COUNT(*) FILTER (WHERE is_active) AS active_users,
+             COUNT(*) FILTER (WHERE last_login IS NOT NULL) AS logged_in_users
+      FROM users
+      GROUP BY organization_name
+      ORDER BY user_count DESC
+
+  - name: never_logged_in
+    description: Users who have never logged in
+    sql: |-
+      SELECT full_name, email, organization_name, role, created_at
+      FROM users
+      WHERE last_login IS NULL AND is_active = true
+      ORDER BY created_at

package/templates/nextjs-standalone/data/cybersec-semantic/entities/vulnerabilities.yml

@@ -0,0 +1,154 @@
+name: Vulnerabilities
+type: dimension_table
+table: vulnerabilities
+grain: one row per known vulnerability (CVE)
+description: |
+  Known vulnerabilities from CVE databases. Each vulnerability has a unique
+  CVE identifier, severity rating (text enum), optional CVSS score (~30% NULL),
+  category classification, and publication date. This is a reference table —
+  actual findings on assets are tracked in scan_results and vulnerability_instances.
+  Use for threat landscape analysis and vulnerability prioritization.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique vulnerability identifier
+    primary_key: true
+
+  - name: cve_id
+    sql: cve_id
+    type: string
+    description: CVE identifier (e.g. CVE-2024-1234)
+    sample_values: [CVE-2024-1234, CVE-2023-44271, CVE-2024-21762, CVE-2023-38545]
+
+  - name: title
+    sql: title
+    type: string
+    description: Short description / title of the vulnerability
+
+  - name: description
+    sql: description
+    type: string
+    description: Detailed description of the vulnerability and its impact
+
+  - name: severity
+    sql: severity
+    type: string
+    description: Severity classification (text enum)
+    sample_values: [critical, high, medium, low, info]
+
+  - name: cvss_score
+    sql: cvss_score
+    type: number
+    description: |
+      CVSS numeric score (0.0–10.0). NULL for ~30% of vulnerabilities where
+      the score has not been assigned. Use COALESCE or filter NULLs when
+      aggregating. Higher score = more severe.
+
+  - name: category
+    sql: category
+    type: string
+    description: Vulnerability category / classification
+    sample_values: [remote_code_execution, sql_injection, cross_site_scripting, privilege_escalation, denial_of_service, buffer_overflow, authentication_bypass]
+
+  - name: published_at
+    sql: published_at
+    type: timestamp
+    description: When the vulnerability was publicly disclosed / published
+
+  - name: created_at
+    sql: created_at
+    type: timestamp
+    description: When the vulnerability was added to the Sentinel database
+
+  - name: severity_rank
+    sql: |-
+      CASE severity
+        WHEN 'critical' THEN 1
+        WHEN 'high' THEN 2
+        WHEN 'medium' THEN 3
+        WHEN 'low' THEN 4
+        WHEN 'info' THEN 5
+        ELSE 6
+      END
+    type: number
+    description: Numeric severity rank for sorting (1 = most severe)
+    virtual: true
+
+  - name: cvss_tier
+    sql: |-
+      CASE
+        WHEN cvss_score IS NULL THEN 'Unscored'
+        WHEN cvss_score >= 9.0 THEN 'Critical (9.0+)'
+        WHEN cvss_score >= 7.0 THEN 'High (7.0-8.9)'
+        WHEN cvss_score >= 4.0 THEN 'Medium (4.0-6.9)'
+        ELSE 'Low (0-3.9)'
+      END
+    type: string
+    description: CVSS score tier bucket (handles NULL scores)
+    virtual: true
+    sample_values: [Unscored, Critical (9.0+), High (7.0-8.9), Medium (4.0-6.9), Low (0-3.9)]
+
+  - name: published_year
+    sql: EXTRACT(YEAR FROM published_at)
+    type: number
+    description: Year the vulnerability was published
+    virtual: true
+
+  - name: published_month
+    sql: TO_CHAR(published_at, 'YYYY-MM')
+    type: string
+    description: Year-month the vulnerability was published
+    virtual: true
+
+measures:
+  - name: vulnerability_count
+    sql: id
+    type: count_distinct
+    description: Number of unique vulnerabilities
+
+  - name: avg_cvss
+    sql: cvss_score
+    type: avg
+    description: Average CVSS score (excludes NULLs)
+
+use_cases:
+  - Vulnerability severity distribution analysis
+  - CVE category trending and prioritization
+  - CVSS score analysis for risk assessment
+  - Threat landscape trending by publication date
+  - Join to scan_results and vulnerability_instances for exposure analysis
+
+query_patterns:
+  - name: vulns_by_severity
+    description: Vulnerability count by severity level
+    sql: |-
+      SELECT severity,
+             COUNT(*) AS vuln_count,
+             AVG(cvss_score) AS avg_cvss
+      FROM vulnerabilities
+      GROUP BY severity
+      ORDER BY MIN(CASE severity
+        WHEN 'critical' THEN 1 WHEN 'high' THEN 2
+        WHEN 'medium' THEN 3 WHEN 'low' THEN 4 ELSE 5 END)
+
+  - name: vulns_by_category
+    description: Vulnerability count by category
+    sql: |-
+      SELECT category,
+             COUNT(*) AS vuln_count,
+             COUNT(*) FILTER (WHERE severity = 'critical') AS critical_count,
+             AVG(cvss_score) AS avg_cvss
+      FROM vulnerabilities
+      GROUP BY category
+      ORDER BY vuln_count DESC
+
+  - name: recent_critical_vulns
+    description: Recently published critical vulnerabilities
+    sql: |-
+      SELECT cve_id, title, cvss_score, category, published_at
+      FROM vulnerabilities
+      WHERE severity = 'critical'
+      ORDER BY published_at DESC
+      LIMIT 20