@useatlas/create 0.0.5 → 0.0.7

package/templates/nextjs-standalone/data/cybersec-semantic/glossary.yml

@@ -0,0 +1,207 @@
+terms:
+  CVSS:
+    status: defined
+    definition: >
+      Common Vulnerability Scoring System. A numeric score (0.0–10.0) rating
+      the severity of a vulnerability. Stored in vulnerabilities.cvss_score.
+      Note: ~30% of vulnerabilities have NULL cvss_score — use COALESCE or
+      filter NULLs when aggregating.
+    tables:
+      - vulnerabilities
+
+  CVE:
+    status: defined
+    definition: >
+      Common Vulnerabilities and Exposures. A unique identifier for a known
+      security vulnerability (e.g. CVE-2024-1234). Stored in vulnerabilities.cve_id.
+    tables:
+      - vulnerabilities
+
+  severity:
+    status: ambiguous
+    note: >
+      "severity" appears on vulnerabilities, incidents, and alerts. ASK the
+      user which entity they mean. Vulnerability severity is a text enum
+      (critical/high/medium/low/info). Incident severity is similar but
+      independent. Alert severity can be NULL.
+    possible_mappings:
+      - vulnerabilities.severity
+      - incidents.severity
+      - alerts.severity
+
+  MTTR:
+    status: defined
+    definition: >
+      Mean Time To Remediate (or Resolve). For scan results, calculated as
+      AVG(resolved_at - found_at) where resolved_at IS NOT NULL. For incidents,
+      calculated as AVG(resolved_at - created_at) where resolved_at IS NOT NULL.
+      Always specify which entity when discussing MTTR.
+    tables:
+      - scan_results
+      - incidents
+
+  MRR:
+    status: defined
+    definition: >
+      Monthly Recurring Revenue. The sum of mrr_cents across all active
+      subscriptions, divided by 100 for dollars. Use subscriptions.mrr_cents
+      and filter by status = 'active' for current MRR.
+    tables:
+      - subscriptions
+
+  ARR:
+    status: defined
+    definition: >
+      Annual Recurring Revenue. MRR * 12. Not stored directly — calculate
+      from subscriptions.mrr_cents.
+    tables:
+      - subscriptions
+
+  churn:
+    status: defined
+    definition: >
+      A subscription with status = 'canceled' or 'past_due' that has not
+      recovered. Churned subscriptions typically have mrr_cents = 0 or are
+      approaching zero. Analyze using subscription_events for transition history.
+    tables:
+      - subscriptions
+
+  SLA:
+    status: defined
+    definition: >
+      Service Level Agreement. In this context, refers to remediation SLA —
+      the expected time to complete a remediation action based on priority.
+      Track via remediation_actions.due_date vs completed_at.
+    tables:
+      - remediation_actions
+
+  IOC:
+    status: defined
+    definition: >
+      Indicator of Compromise. Observable artifacts (IP addresses, file hashes,
+      domains, URLs) that indicate a system may have been compromised. Stored
+      in indicators_of_compromise with type and value fields.
+    tables:
+      - indicators_of_compromise
+
+  risk_level:
+    status: defined
+    definition: >
+      A numeric score (1–10) assigned to scan results indicating the risk
+      a specific finding poses. Higher = more critical. Stored in
+      scan_results.risk_level. Distinct from CVSS (which rates the
+      vulnerability itself) — risk_level accounts for asset context.
+    tables:
+      - scan_results
+
+  status:
+    status: ambiguous
+    note: >
+      "status" appears on many entities with different meanings. ASK for
+      context. Common uses: subscriptions (active/canceled/past_due/trialing),
+      scans (pending/running/completed/failed), scan_results (open/resolved/
+      false_positive), incidents (open/investigating/contained/resolved/closed),
+      remediation_actions (open/in_progress/completed/deferred).
+    possible_mappings:
+      - subscriptions.status
+      - scans.status
+      - scan_results.status
+      - incidents.status
+      - remediation_actions.status
+      - alerts.status
+      - compliance_assessments.status
+
+  asset:
+    status: defined
+    definition: >
+      An IT resource monitored by Sentinel Security — servers, workstations,
+      network devices, containers, or cloud instances. Each asset belongs to
+      one organization and has a type, OS, environment, and activity timestamps.
+    tables:
+      - assets
+
+  finding:
+    status: defined
+    definition: >
+      A specific vulnerability detected on a specific asset during a scan.
+      Stored in scan_results. Each finding has a risk_level, status, and
+      timestamps for discovery (found_at) and resolution (resolved_at).
+    tables:
+      - scan_results
+
+  scan:
+    status: defined
+    definition: >
+      A vulnerability scan execution. Can be full, incremental, or compliance
+      type. Runs against an organization's assets and produces scan_results
+      (findings). Track coverage via assets_scanned and findings_count.
+    tables:
+      - scans
+
+  incident:
+    status: defined
+    definition: >
+      A security incident requiring investigation and response. Has severity
+      (critical/high/medium/low), status lifecycle (open → investigating →
+      contained → resolved → closed), and optional assignment to a user.
+    tables:
+      - incidents
+
+  remediation:
+    status: defined
+    definition: >
+      The process of fixing a vulnerability finding. Tracked via
+      remediation_actions with priority (critical/high/medium/low),
+      assignment, due date, and completion date. Links to vulnerability_instances.
+    tables:
+      - remediation_actions
+
+  compliance_framework:
+    status: defined
+    definition: >
+      A regulatory or industry standard (SOC 2, ISO 27001, HIPAA, PCI DSS,
+      NIST CSF, GDPR, CIS Benchmarks). Organizations are assessed against
+      frameworks via compliance_assessments which produce a score.
+    tables:
+      - compliance_frameworks
+      - compliance_assessments
+
+  environment:
+    status: defined
+    definition: >
+      The deployment environment of an asset. Values: production, staging,
+      development. Use assets.environment to filter or segment analysis.
+      Production assets typically receive higher priority for remediation.
+    tables:
+      - assets
+
+  name:
+    status: ambiguous
+    note: >
+      "name" appears in many entities — organizations.name, users.full_name,
+      plans.name, vulnerabilities.title, incidents.title. ASK the user
+      which entity they mean.
+    possible_mappings:
+      - organizations.name
+      - users.full_name
+      - plans.name
+      - plans.display_name
+
+  plan:
+    status: defined
+    definition: >
+      Subscription tier. Plans include starter, professional, enterprise,
+      and custom tiers with varying asset limits, user limits, and features.
+      Pricing stored in plans.price_cents.
+    tables:
+      - plans
+      - subscriptions
+
+  size_tier:
+    status: defined
+    definition: >
+      Organization size classification. Values typically: small, medium,
+      large, enterprise. Stored in organizations.size_tier. Determines
+      expected asset counts and appropriate plan recommendations.
+    tables:
+      - organizations

package/templates/nextjs-standalone/data/cybersec-semantic/metrics/business.yml

@@ -0,0 +1,148 @@
+metrics:
+  - id: total_mrr
+    label: Total MRR
+    description: Total Monthly Recurring Revenue across all active subscriptions (in dollars).
+    type: atomic
+    unit: USD
+    source:
+      entity: Subscriptions
+      measure: total_mrr_cents
+    sql: |-
+      SELECT SUM(mrr_cents) / 100.0 AS total_mrr_dollars
+      FROM subscriptions
+      WHERE status = 'active'
+    aggregation: sum
+    objective: maximize
+
+  - id: total_arr
+    label: Total ARR
+    description: Annual Recurring Revenue — MRR * 12. Calculated from active subscriptions.
+    type: derived
+    unit: USD
+    sql: |-
+      SELECT SUM(mrr_cents) / 100.0 * 12 AS total_arr_dollars
+      FROM subscriptions
+      WHERE status = 'active'
+    aggregation: sum
+    objective: maximize
+
+  - id: active_customers
+    label: Active Customers
+    description: Number of active organizations on the platform.
+    type: atomic
+    source:
+      entity: Organizations
+      measure: active_org_count
+    sql: |-
+      SELECT COUNT(*) AS active_customers
+      FROM organizations
+      WHERE is_active = true
+    aggregation: count
+    objective: maximize
+
+  - id: active_subscriptions
+    label: Active Subscriptions
+    description: Number of subscriptions with status 'active'.
+    type: atomic
+    sql: |-
+      SELECT COUNT(*) AS active_subscriptions
+      FROM subscriptions
+      WHERE status = 'active'
+    aggregation: count
+
+  - id: arpa
+    label: ARPA (Avg Revenue Per Account)
+    description: Average MRR per active subscription (in dollars).
+    type: derived
+    unit: USD
+    sql: |-
+      SELECT AVG(mrr_cents) / 100.0 AS arpa_dollars
+      FROM subscriptions
+      WHERE status = 'active'
+    aggregation: avg
+
+  - id: churn_rate
+    label: Churn Rate
+    description: Percentage of all subscriptions that have been canceled.
+    type: derived
+    unit: percent
+    sql: |-
+      SELECT ROUND(100.0 * COUNT(*) FILTER (WHERE status = 'canceled') / COUNT(*), 1) AS churn_rate
+      FROM subscriptions
+    aggregation: ratio
+    objective: minimize
+
+  - id: mrr_by_plan
+    label: MRR by Plan
+    description: MRR breakdown by subscription plan tier.
+    type: breakdown
+    unit: USD
+    sql: |-
+      SELECT plan_name,
+             SUM(mrr_cents) / 100.0 AS total_mrr_dollars,
+             COUNT(*) AS subscription_count,
+             AVG(mrr_cents) / 100.0 AS avg_mrr_dollars
+      FROM subscriptions
+      WHERE status = 'active'
+      GROUP BY plan_name
+      ORDER BY total_mrr_dollars DESC
+
+  - id: churn_by_plan
+    label: Churn Rate by Plan
+    description: Churn rate broken down by plan tier.
+    type: breakdown
+    unit: percent
+    sql: |-
+      SELECT plan_name,
+             COUNT(*) FILTER (WHERE status = 'canceled') AS churned,
+             COUNT(*) AS total,
+             ROUND(100.0 * COUNT(*) FILTER (WHERE status = 'canceled') / COUNT(*), 1) AS churn_pct
+      FROM subscriptions
+      GROUP BY plan_name
+      ORDER BY churn_pct DESC
+    objective: minimize
+
+  - id: mrr_by_industry
+    label: MRR by Industry
+    description: MRR breakdown by customer industry vertical.
+    type: breakdown
+    unit: USD
+    sql: |-
+      SELECT o.industry,
+             SUM(s.mrr_cents) / 100.0 AS total_mrr_dollars,
+             COUNT(DISTINCT o.id) AS org_count
+      FROM subscriptions s
+      JOIN organizations o ON s.organization_id = o.id
+      WHERE s.status = 'active'
+      GROUP BY o.industry
+      ORDER BY total_mrr_dollars DESC
+
+  - id: mrr_by_size_tier
+    label: MRR by Organization Size
+    description: MRR breakdown by organization size tier.
+    type: breakdown
+    unit: USD
+    sql: |-
+      SELECT o.size_tier,
+             SUM(s.mrr_cents) / 100.0 AS total_mrr_dollars,
+             COUNT(DISTINCT o.id) AS org_count,
+             AVG(s.mrr_cents) / 100.0 AS avg_mrr_dollars
+      FROM subscriptions s
+      JOIN organizations o ON s.organization_id = o.id
+      WHERE s.status = 'active'
+      GROUP BY o.size_tier
+      ORDER BY total_mrr_dollars DESC
+
+  - id: subscription_cohort
+    label: Subscription Cohort Analysis
+    description: MRR and subscription count by cohort (start year-month).
+    type: breakdown
+    unit: USD
+    sql: |-
+      SELECT TO_CHAR(started_at, 'YYYY-MM') AS cohort_month,
+             COUNT(*) AS subscriptions,
+             SUM(mrr_cents) / 100.0 AS total_mrr_dollars,
+             COUNT(*) FILTER (WHERE status = 'canceled') AS churned
+      FROM subscriptions
+      GROUP BY cohort_month
+      ORDER BY cohort_month

package/templates/nextjs-standalone/data/cybersec-semantic/metrics/compliance.yml

@@ -0,0 +1,138 @@
+metrics:
+  - id: avg_compliance_score
+    label: Average Compliance Score
+    description: Average compliance assessment score across all completed assessments.
+    type: atomic
+    source:
+      entity: Compliance Assessments
+      measure: avg_score
+    sql: |-
+      SELECT AVG(score) AS avg_compliance_score
+      FROM compliance_assessments
+      WHERE status = 'completed'
+    aggregation: avg
+    objective: maximize
+
+  - id: compliance_pass_rate
+    label: Compliance Pass Rate
+    description: >
+      Percentage of completed assessments that scored 70 or above (passing threshold).
+    type: derived
+    unit: percent
+    sql: |-
+      SELECT ROUND(100.0 * COUNT(*) FILTER (WHERE score >= 70) / COUNT(*), 1) AS pass_rate
+      FROM compliance_assessments
+      WHERE status = 'completed'
+    aggregation: ratio
+    objective: maximize
+
+  - id: assessments_completed
+    label: Assessments Completed
+    description: Total number of completed compliance assessments.
+    type: atomic
+    source:
+      entity: Compliance Assessments
+      measure: completed_count
+    sql: |-
+      SELECT COUNT(*) AS assessments_completed
+      FROM compliance_assessments
+      WHERE status = 'completed'
+    aggregation: count
+
+  - id: avg_score_by_framework
+    label: Avg Score by Framework
+    description: Average compliance score broken down by regulatory framework.
+    type: breakdown
+    sql: |-
+      SELECT cf.name AS framework,
+             COUNT(ca.id) AS assessment_count,
+             AVG(ca.score) AS avg_score,
+             MIN(ca.score) AS min_score,
+             MAX(ca.score) AS max_score,
+             ROUND(100.0 * COUNT(*) FILTER (WHERE ca.score >= 70) / COUNT(*), 1) AS pass_rate
+      FROM compliance_assessments ca
+      JOIN compliance_frameworks cf ON ca.framework_id = cf.id
+      WHERE ca.status = 'completed'
+      GROUP BY cf.name
+      ORDER BY avg_score DESC
+    objective: maximize
+
+  - id: framework_coverage
+    label: Framework Coverage
+    description: >
+      Number of organizations that have been assessed against each framework,
+      and what percentage of all active organizations that represents.
+    type: breakdown
+    sql: |-
+      SELECT cf.name AS framework,
+             COUNT(DISTINCT ca.organization_id) AS orgs_assessed,
+             (SELECT COUNT(*) FROM organizations WHERE is_active = true) AS total_active_orgs,
+             ROUND(100.0 * COUNT(DISTINCT ca.organization_id) /
+                   (SELECT COUNT(*) FROM organizations WHERE is_active = true), 1) AS coverage_pct
+      FROM compliance_assessments ca
+      JOIN compliance_frameworks cf ON ca.framework_id = cf.id
+      GROUP BY cf.name
+      ORDER BY orgs_assessed DESC
+    objective: maximize
+
+  - id: compliance_by_industry
+    label: Compliance Score by Industry
+    description: Average compliance score broken down by customer industry.
+    type: breakdown
+    sql: |-
+      SELECT o.industry,
+             COUNT(ca.id) AS assessment_count,
+             AVG(ca.score) AS avg_score,
+             ROUND(100.0 * COUNT(*) FILTER (WHERE ca.score >= 70) / COUNT(*), 1) AS pass_rate
+      FROM compliance_assessments ca
+      JOIN organizations o ON ca.organization_id = o.id
+      WHERE ca.status = 'completed'
+      GROUP BY o.industry
+      ORDER BY avg_score DESC
+
+  - id: compliance_by_size_tier
+    label: Compliance Score by Org Size
+    description: Average compliance score broken down by organization size tier.
+    type: breakdown
+    sql: |-
+      SELECT o.size_tier,
+             COUNT(ca.id) AS assessment_count,
+             AVG(ca.score) AS avg_score,
+             ROUND(100.0 * COUNT(*) FILTER (WHERE ca.score >= 70) / COUNT(*), 1) AS pass_rate
+      FROM compliance_assessments ca
+      JOIN organizations o ON ca.organization_id = o.id
+      WHERE ca.status = 'completed'
+      GROUP BY o.size_tier
+      ORDER BY avg_score DESC
+
+  - id: compliance_trend
+    label: Compliance Score Trend
+    description: Monthly average compliance score trend for completed assessments.
+    type: breakdown
+    sql: |-
+      SELECT TO_CHAR(completed_at, 'YYYY-MM') AS month,
+             COUNT(*) AS assessments_completed,
+             AVG(score) AS avg_score,
+             ROUND(100.0 * COUNT(*) FILTER (WHERE score >= 70) / COUNT(*), 1) AS pass_rate
+      FROM compliance_assessments
+      WHERE status = 'completed' AND completed_at IS NOT NULL
+      GROUP BY month
+      ORDER BY month
+
+  - id: low_scoring_orgs
+    label: Low-Scoring Organizations
+    description: Organizations with average compliance score below 50 — need attention.
+    type: breakdown
+    sql: |-
+      SELECT o.name AS organization,
+             o.industry,
+             o.size_tier,
+             COUNT(ca.id) AS assessment_count,
+             AVG(ca.score) AS avg_score
+      FROM compliance_assessments ca
+      JOIN organizations o ON ca.organization_id = o.id
+      WHERE ca.status = 'completed'
+      GROUP BY o.name, o.industry, o.size_tier
+      HAVING AVG(ca.score) < 50
+      ORDER BY avg_score
+    objective: minimize

package/templates/nextjs-standalone/data/cybersec-semantic/metrics/security.yml

@@ -0,0 +1,181 @@
+metrics:
+  - id: open_findings
+    label: Open Findings
+    description: Total number of vulnerability findings with status 'open' across all organizations.
+    type: atomic
+    source:
+      entity: Scan Results
+      measure: open_finding_count
+    sql: |-
+      SELECT COUNT(*) AS open_findings
+      FROM scan_results
+      WHERE status = 'open'
+    aggregation: count
+    objective: minimize
+
+  - id: total_findings
+    label: Total Findings
+    description: Total number of vulnerability findings across all statuses.
+    type: atomic
+    source:
+      entity: Scan Results
+      measure: finding_count
+    sql: |-
+      SELECT COUNT(*) AS total_findings
+      FROM scan_results
+    aggregation: count
+
+  - id: finding_resolution_rate
+    label: Finding Resolution Rate
+    description: Percentage of all findings that have been resolved.
+    type: derived
+    unit: percent
+    sql: |-
+      SELECT ROUND(100.0 * COUNT(*) FILTER (WHERE status = 'resolved') / COUNT(*), 1) AS resolution_rate
+      FROM scan_results
+    aggregation: ratio
+    objective: maximize
+
+  - id: mttr_findings
+    label: MTTR (Findings)
+    description: >
+      Mean Time To Remediate for scan result findings. Average days between
+      found_at and resolved_at for resolved findings.
+    type: derived
+    unit: days
+    sql: |-
+      SELECT AVG(EXTRACT(DAY FROM (resolved_at - found_at))) AS mttr_days
+      FROM scan_results
+      WHERE resolved_at IS NOT NULL
+    aggregation: avg
+    objective: minimize
+
+  - id: mttr_findings_by_risk
+    label: MTTR by Risk Tier
+    description: Mean time to remediate broken down by risk level tier.
+    type: breakdown
+    unit: days
+    sql: |-
+      SELECT CASE
+               WHEN risk_level >= 9 THEN 'Critical (9-10)'
+               WHEN risk_level >= 7 THEN 'High (7-8)'
+               WHEN risk_level >= 4 THEN 'Medium (4-6)'
+               ELSE 'Low (1-3)'
+             END AS risk_tier,
+             COUNT(*) AS finding_count,
+             AVG(EXTRACT(DAY FROM (resolved_at - found_at))) AS mttr_days
+      FROM scan_results
+      WHERE resolved_at IS NOT NULL
+      GROUP BY risk_tier
+      ORDER BY MIN(risk_level) DESC
+    objective: minimize
+
+  - id: open_incidents
+    label: Open Incidents
+    description: Number of incidents that are not yet resolved or closed.
+    type: atomic
+    source:
+      entity: Incidents
+      measure: open_incident_count
+    sql: |-
+      SELECT COUNT(*) AS open_incidents
+      FROM incidents
+      WHERE status NOT IN ('resolved', 'closed')
+    aggregation: count
+    objective: minimize
+
+  - id: mttr_incidents
+    label: MTTR (Incidents)
+    description: >
+      Mean Time To Resolve for security incidents. Average hours between
+      created_at and resolved_at for resolved incidents.
+    type: derived
+    unit: hours
+    sql: |-
+      SELECT AVG(EXTRACT(EPOCH FROM (resolved_at - created_at)) / 3600.0) AS mttr_hours
+      FROM incidents
+      WHERE resolved_at IS NOT NULL
+    aggregation: avg
+    objective: minimize
+
+  - id: mttr_incidents_by_severity
+    label: Incident MTTR by Severity
+    description: Mean time to resolve incidents broken down by severity.
+    type: breakdown
+    unit: hours
+    sql: |-
+      SELECT severity,
+             COUNT(*) AS incident_count,
+             AVG(EXTRACT(EPOCH FROM (resolved_at - created_at)) / 3600.0) AS mttr_hours
+      FROM incidents
+      WHERE resolved_at IS NOT NULL
+      GROUP BY severity
+      ORDER BY MIN(CASE severity
+        WHEN 'critical' THEN 1 WHEN 'high' THEN 2
+        WHEN 'medium' THEN 3 WHEN 'low' THEN 4 ELSE 5 END)
+    objective: minimize
+
+  - id: alert_escalation_rate
+    label: Alert Escalation Rate
+    description: Percentage of alerts that are linked to an incident (escalated).
+    type: derived
+    unit: percent
+    sql: |-
+      SELECT ROUND(100.0 * COUNT(*) FILTER (WHERE incident_id IS NOT NULL) / COUNT(*), 1) AS escalation_rate
+      FROM alerts
+    aggregation: ratio
+
+  - id: avg_alert_ack_time
+    label: Avg Alert Acknowledgment Time
+    description: Average minutes between alert creation and first acknowledgment.
+    type: derived
+    unit: minutes
+    sql: |-
+      SELECT AVG(EXTRACT(EPOCH FROM (acknowledged_at - created_at)) / 60.0) AS avg_ack_minutes
+      FROM alerts
+      WHERE acknowledged_at IS NOT NULL
+    aggregation: avg
+    objective: minimize
+
+  - id: overdue_remediations
+    label: Overdue Remediations
+    description: Number of remediation actions past their due date that are not completed.
+    type: atomic
+    source:
+      entity: Remediation Actions
+      measure: overdue_count
+    sql: |-
+      SELECT COUNT(*) AS overdue_count
+      FROM remediation_actions
+      WHERE status NOT IN ('completed', 'deferred')
+        AND due_date < CURRENT_DATE
+    aggregation: count
+    objective: minimize
+
+  - id: remediation_completion_rate
+    label: Remediation Completion Rate
+    description: Percentage of all remediation actions that have been completed.
+    type: derived
+    unit: percent
+    sql: |-
+      SELECT ROUND(100.0 * COUNT(*) FILTER (WHERE status = 'completed') / COUNT(*), 1) AS completion_rate
+      FROM remediation_actions
+    aggregation: ratio
+    objective: maximize
+
+  - id: vulnerability_density_by_org
+    label: Vulnerability Density by Organization
+    description: Average open findings per active asset, by organization.
+    type: breakdown
+    sql: |-
+      SELECT o.name AS organization,
+             COUNT(DISTINCT a.id) AS active_assets,
+             COUNT(sr.id) FILTER (WHERE sr.status = 'open') AS open_findings,
+             ROUND(COUNT(sr.id) FILTER (WHERE sr.status = 'open')::NUMERIC /
+                   NULLIF(COUNT(DISTINCT a.id), 0), 2) AS findings_per_asset
+      FROM organizations o
+      JOIN assets a ON a.organization_id = o.id AND a.is_active = true
+      LEFT JOIN scan_results sr ON sr.asset_id = a.id
+      GROUP BY o.name
+      ORDER BY findings_per_asset DESC
+    objective: minimize