@useatlas/create 0.0.6 → 0.0.7

package/templates/nextjs-standalone/data/cybersec-semantic/entities/assets.yml

@@ -0,0 +1,191 @@
+name: Assets
+type: dimension_table
+table: assets
+grain: one row per IT asset
+description: |
+  IT assets monitored by the Sentinel Security platform. Includes servers,
+  workstations, network devices, containers, and cloud instances. Each asset
+  belongs to one organization and has a type, OS, environment classification,
+  and activity timestamps. display_name is NULL for ~40% of assets — use
+  hostname as the primary identifier. Assets are linked to scan_results and
+  vulnerability_instances for security analysis.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique asset identifier
+    primary_key: true
+
+  - name: organization_id
+    sql: organization_id
+    type: number
+    description: Foreign key to organizations — which customer owns this asset
+
+  - name: hostname
+    sql: hostname
+    type: string
+    description: Network hostname of the asset (always populated)
+    sample_values: [web-prod-01, db-staging-03, app-dev-12, fw-edge-01]
+
+  - name: display_name
+    sql: display_name
+    type: string
+    description: |
+      Human-readable display name. NULL for ~40% of assets — fall back to
+      hostname when display_name is not set.
+
+  - name: asset_type
+    sql: asset_type
+    type: string
+    description: Type of IT asset
+    sample_values: [server, workstation, network_device, container, cloud_instance]
+
+  - name: ip_address
+    sql: ip_address
+    type: string
+    description: IP address of the asset
+
+  - name: os
+    sql: os
+    type: string
+    description: Operating system
+    sample_values: [Linux, Windows, macOS, Ubuntu, CentOS, RHEL, Debian]
+
+  - name: os_version
+    sql: os_version
+    type: string
+    description: Operating system version string
+
+  - name: environment
+    sql: environment
+    type: string
+    description: Deployment environment classification
+    sample_values: [production, staging, development]
+
+  - name: is_active
+    sql: is_active
+    type: boolean
+    description: Whether the asset is currently being monitored
+
+  - name: first_seen
+    sql: first_seen
+    type: timestamp
+    description: When the asset was first discovered by the platform
+
+  - name: last_seen
+    sql: last_seen
+    type: timestamp
+    description: When the asset was last observed / checked in
+
+  - name: created_at
+    sql: created_at
+    type: timestamp
+    description: When the asset record was created
+
+  - name: effective_name
+    sql: COALESCE(display_name, hostname)
+    type: string
+    description: Display name if set, otherwise hostname — use this for user-facing labels
+    virtual: true
+
+  - name: days_since_last_seen
+    sql: EXTRACT(DAY FROM (CURRENT_TIMESTAMP - last_seen))
+    type: number
+    description: Days since the asset was last observed — high values indicate stale/offline assets
+    virtual: true
+
+  - name: staleness_bucket
+    sql: |-
+      CASE
+        WHEN last_seen >= CURRENT_TIMESTAMP - INTERVAL '1 day' THEN 'Active (today)'
+        WHEN last_seen >= CURRENT_TIMESTAMP - INTERVAL '7 days' THEN 'Recent (this week)'
+        WHEN last_seen >= CURRENT_TIMESTAMP - INTERVAL '30 days' THEN 'Stale (this month)'
+        ELSE 'Offline (30+ days)'
+      END
+    type: string
+    description: Staleness bucket based on last_seen
+    virtual: true
+    sample_values: [Active (today), Recent (this week), Stale (this month), Offline (30+ days)]
+
+  - name: os_family
+    sql: |-
+      CASE
+        WHEN os IN ('Linux', 'Ubuntu', 'CentOS', 'RHEL', 'Debian') THEN 'Linux'
+        WHEN os = 'Windows' THEN 'Windows'
+        WHEN os = 'macOS' THEN 'macOS'
+        ELSE 'Other'
+      END
+    type: string
+    description: Simplified OS family grouping
+    virtual: true
+    sample_values: [Linux, Windows, macOS, Other]
+
+measures:
+  - name: asset_count
+    sql: id
+    type: count_distinct
+    description: Number of unique assets
+
+  - name: active_asset_count
+    sql: CASE WHEN is_active THEN id END
+    type: count_distinct
+    description: Number of active (monitored) assets
+
+joins:
+  - target_entity: Organizations
+    relationship: many_to_one
+    join_columns:
+      from: organization_id
+      to: id
+    description: Each asset belongs to one organization
+
+use_cases:
+  - Asset inventory and coverage analysis by organization
+  - Environment breakdown (production vs staging vs development)
+  - OS distribution and version tracking for patch management
+  - Stale asset detection — assets not seen recently
+  - Join to scan_results for per-asset vulnerability density
+
+query_patterns:
+  - name: assets_by_type
+    description: Asset count by type
+    sql: |-
+      SELECT asset_type,
+             COUNT(*) AS asset_count,
+             COUNT(*) FILTER (WHERE is_active) AS active_count
+      FROM assets
+      GROUP BY asset_type
+      ORDER BY asset_count DESC
+
+  - name: assets_by_environment
+    description: Asset distribution by environment
+    sql: |-
+      SELECT environment,
+             COUNT(*) AS asset_count,
+             COUNT(*) FILTER (WHERE is_active) AS active_count
+      FROM assets
+      GROUP BY environment
+      ORDER BY asset_count DESC
+
+  - name: assets_per_org
+    description: Asset density per organization
+    sql: |-
+      SELECT o.name AS organization,
+             COUNT(a.id) AS asset_count,
+             COUNT(DISTINCT a.asset_type) AS asset_types,
+             COUNT(*) FILTER (WHERE a.environment = 'production') AS prod_assets
+      FROM assets a
+      JOIN organizations o ON a.organization_id = o.id
+      WHERE a.is_active = true
+      GROUP BY o.name
+      ORDER BY asset_count DESC
+
+  - name: stale_assets
+    description: Assets not seen in the last 30 days
+    sql: |-
+      SELECT hostname, asset_type, os, environment, last_seen
+      FROM assets
+      WHERE is_active = true
+        AND last_seen < CURRENT_TIMESTAMP - INTERVAL '30 days'
+      ORDER BY last_seen

package/templates/nextjs-standalone/data/cybersec-semantic/entities/compliance_assessments.yml

@@ -0,0 +1,170 @@
+name: Compliance Assessments
+type: fact_table
+table: compliance_assessments
+grain: one row per compliance assessment
+description: |
+  Compliance assessments conducted against regulatory frameworks for customer
+  organizations. Each assessment evaluates an organization against a specific
+  framework (SOC 2, ISO 27001, HIPAA, etc.) and produces a score. Tracks
+  assessment lifecycle from initiation to completion. Use for compliance
+  readiness analysis, score trending, and framework coverage tracking.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique assessment identifier
+    primary_key: true
+
+  - name: organization_id
+    sql: organization_id
+    type: number
+    description: Foreign key to organizations — which customer was assessed
+
+  - name: framework_id
+    sql: framework_id
+    type: number
+    description: Foreign key to compliance_frameworks — which framework was assessed against
+
+  - name: status
+    sql: status
+    type: string
+    description: Current assessment status
+    sample_values: [pending, in_progress, completed, failed]
+
+  - name: started_at
+    sql: started_at
+    type: timestamp
+    description: When the assessment began
+
+  - name: completed_at
+    sql: completed_at
+    type: timestamp
+    description: When the assessment was completed (NULL if still in progress)
+
+  - name: score
+    sql: score
+    type: number
+    description: |
+      Compliance score (0–100) representing the organization's compliance
+      level against the framework. Higher = more compliant. NULL if the
+      assessment has not been completed.
+
+  - name: created_at
+    sql: created_at
+    type: timestamp
+    description: When the assessment record was created
+
+  - name: score_tier
+    sql: |-
+      CASE
+        WHEN score IS NULL THEN 'Not Scored'
+        WHEN score >= 90 THEN 'Excellent (90-100)'
+        WHEN score >= 70 THEN 'Good (70-89)'
+        WHEN score >= 50 THEN 'Fair (50-69)'
+        ELSE 'Poor (0-49)'
+      END
+    type: string
+    description: Compliance score tier bucket
+    virtual: true
+    sample_values: [Not Scored, Excellent (90-100), Good (70-89), Fair (50-69), Poor (0-49)]
+
+  - name: is_completed
+    sql: CASE WHEN status = 'completed' THEN true ELSE false END
+    type: boolean
+    description: Whether the assessment has been completed
+    virtual: true
+
+  - name: is_passing
+    sql: CASE WHEN score >= 70 THEN true ELSE false END
+    type: boolean
+    description: Whether the assessment score meets the passing threshold (70+)
+    virtual: true
+
+  - name: duration_days
+    sql: |-
+      CASE
+        WHEN completed_at IS NOT NULL AND started_at IS NOT NULL
+        THEN EXTRACT(DAY FROM (completed_at - started_at))
+      END
+    type: number
+    description: Assessment duration in days (NULL if not completed)
+    virtual: true
+
+  - name: completed_month
+    sql: |-
+      CASE
+        WHEN completed_at IS NOT NULL
+        THEN TO_CHAR(completed_at, 'YYYY-MM')
+      END
+    type: string
+    description: Year-month the assessment was completed
+    virtual: true
+
+measures:
+  - name: assessment_count
+    sql: id
+    type: count_distinct
+    description: Number of unique assessments
+
+  - name: completed_count
+    sql: CASE WHEN status = 'completed' THEN id END
+    type: count_distinct
+    description: Number of completed assessments
+
+  - name: avg_score
+    sql: score
+    type: avg
+    description: Average compliance score (excludes NULLs)
+
+joins:
+  - target_entity: Organizations
+    relationship: many_to_one
+    join_columns:
+      from: organization_id
+      to: id
+    description: Each assessment belongs to one organization
+
+use_cases:
+  - Compliance score tracking by framework across organizations
+  - Assessment completion rate and pipeline analysis
+  - Organization compliance readiness comparison
+  - Score trending over time (improvement tracking)
+  - Framework coverage analysis (which frameworks have assessments)
+
+query_patterns:
+  - name: avg_score_by_framework
+    description: Average compliance score by framework
+    sql: |-
+      SELECT cf.name AS framework,
+             COUNT(ca.id) AS assessment_count,
+             AVG(ca.score) AS avg_score,
+             MIN(ca.score) AS min_score,
+             MAX(ca.score) AS max_score
+      FROM compliance_assessments ca
+      JOIN compliance_frameworks cf ON ca.framework_id = cf.id
+      WHERE ca.status = 'completed'
+      GROUP BY cf.name
+      ORDER BY avg_score DESC
+
+  - name: org_compliance_overview
+    description: Compliance score overview by organization
+    sql: |-
+      SELECT o.name AS organization,
+             COUNT(ca.id) AS total_assessments,
+             COUNT(*) FILTER (WHERE ca.status = 'completed') AS completed,
+             AVG(ca.score) FILTER (WHERE ca.status = 'completed') AS avg_score
+      FROM compliance_assessments ca
+      JOIN organizations o ON ca.organization_id = o.id
+      GROUP BY o.name
+      ORDER BY avg_score
+
+  - name: assessment_status_breakdown
+    description: Assessment count by status
+    sql: |-
+      SELECT status,
+             COUNT(*) AS count,
+             AVG(score) AS avg_score
+      FROM compliance_assessments
+      GROUP BY status
+      ORDER BY count DESC

package/templates/nextjs-standalone/data/cybersec-semantic/entities/incidents.yml

@@ -0,0 +1,219 @@
+name: Incidents
+type: fact_table
+table: incidents
+grain: one row per security incident
+description: |
+  Security incidents reported across customer organizations. Each incident
+  has a severity, status lifecycle, optional assignment, and resolution
+  timestamps. organization_name is denormalized from organizations.
+  Core table for incident response metrics, MTTR analysis, and workload
+  tracking. Incidents may be linked from alerts via alerts.incident_id.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique incident identifier
+    primary_key: true
+
+  - name: organization_id
+    sql: organization_id
+    type: number
+    description: Foreign key to organizations — which customer reported this incident
+
+  - name: organization_name
+    sql: organization_name
+    type: string
+    description: Denormalized organization name (from organizations table)
+
+  - name: title
+    sql: title
+    type: string
+    description: Short description / title of the incident
+
+  - name: description
+    sql: description
+    type: string
+    description: Detailed description of the incident
+
+  - name: severity
+    sql: severity
+    type: string
+    description: Incident severity level
+    sample_values: [critical, high, medium, low]
+
+  - name: status
+    sql: status
+    type: string
+    description: |
+      Incident lifecycle status. Progresses through: open → investigating →
+      contained → resolved → closed. Not all incidents pass through every stage.
+    sample_values: [open, investigating, contained, resolved, closed]
+
+  - name: assigned_to
+    sql: assigned_to
+    type: number
+    description: Foreign key to users — who is assigned to handle this incident (may be NULL)
+
+  - name: created_at
+    sql: created_at
+    type: timestamp
+    description: When the incident was created / reported
+
+  - name: updated_at
+    sql: updated_at
+    type: timestamp
+    description: Last time the incident record was modified
+
+  - name: resolved_at
+    sql: resolved_at
+    type: timestamp
+    description: When the incident was resolved (NULL if still open)
+
+  - name: severity_rank
+    sql: |-
+      CASE severity
+        WHEN 'critical' THEN 1
+        WHEN 'high' THEN 2
+        WHEN 'medium' THEN 3
+        WHEN 'low' THEN 4
+        ELSE 5
+      END
+    type: number
+    description: Numeric severity rank for sorting (1 = most severe)
+    virtual: true
+
+  - name: is_open
+    sql: CASE WHEN status NOT IN ('resolved', 'closed') THEN true ELSE false END
+    type: boolean
+    description: Whether the incident is still open (not resolved or closed)
+    virtual: true
+
+  - name: is_resolved
+    sql: CASE WHEN status IN ('resolved', 'closed') THEN true ELSE false END
+    type: boolean
+    description: Whether the incident has been resolved or closed
+    virtual: true
+
+  - name: resolution_hours
+    sql: |-
+      CASE
+        WHEN resolved_at IS NOT NULL
+        THEN EXTRACT(EPOCH FROM (resolved_at - created_at)) / 3600.0
+      END
+    type: number
+    description: Hours between creation and resolution (NULL if still open)
+    virtual: true
+
+  - name: resolution_days
+    sql: |-
+      CASE
+        WHEN resolved_at IS NOT NULL
+        THEN EXTRACT(DAY FROM (resolved_at - created_at))
+      END
+    type: number
+    description: Days between creation and resolution (NULL if still open)
+    virtual: true
+
+  - name: created_date
+    sql: created_at::DATE
+    type: date
+    description: Date the incident was created (for daily grouping)
+    virtual: true
+
+  - name: created_month
+    sql: TO_CHAR(created_at, 'YYYY-MM')
+    type: string
+    description: Year-month the incident was created
+    virtual: true
+
+  - name: age_days
+    sql: |-
+      CASE
+        WHEN resolved_at IS NULL
+        THEN EXTRACT(DAY FROM (CURRENT_TIMESTAMP - created_at))
+        ELSE EXTRACT(DAY FROM (resolved_at - created_at))
+      END
+    type: number
+    description: Age in days — time to resolve (if resolved) or time since creation (if open)
+    virtual: true
+
+  - name: is_assigned
+    sql: CASE WHEN assigned_to IS NOT NULL THEN true ELSE false END
+    type: boolean
+    description: Whether the incident has been assigned to someone
+    virtual: true
+
+measures:
+  - name: incident_count
+    sql: id
+    type: count_distinct
+    description: Number of unique incidents
+
+  - name: open_incident_count
+    sql: CASE WHEN status NOT IN ('resolved', 'closed') THEN id END
+    type: count_distinct
+    description: Number of currently open incidents
+
+  - name: avg_resolution_hours
+    sql: CASE WHEN resolved_at IS NOT NULL THEN EXTRACT(EPOCH FROM (resolved_at - created_at)) / 3600.0 END
+    type: avg
+    description: Average hours to resolve an incident (MTTR)
+
+joins:
+  - target_entity: Organizations
+    relationship: many_to_one
+    join_columns:
+      from: organization_id
+      to: id
+    description: Each incident belongs to one organization
+
+  - target_entity: Users
+    relationship: many_to_one
+    join_columns:
+      from: assigned_to
+      to: id
+    description: Each incident may be assigned to one user
+
+use_cases:
+  - Incident volume and severity trending over time
+  - Mean time to resolve (MTTR) analysis by severity
+  - Assignment workload and unassigned incident tracking
+  - Organization-level incident comparison
+  - Incident status pipeline analysis (open → investigating → resolved)
+
+query_patterns:
+  - name: incidents_by_severity
+    description: Incident count and MTTR by severity
+    sql: |-
+      SELECT severity,
+             COUNT(*) AS incident_count,
+             COUNT(*) FILTER (WHERE status NOT IN ('resolved', 'closed')) AS open_count,
+             AVG(EXTRACT(EPOCH FROM (resolved_at - created_at)) / 3600.0)
+               FILTER (WHERE resolved_at IS NOT NULL) AS avg_mttr_hours
+      FROM incidents
+      GROUP BY severity
+      ORDER BY MIN(CASE severity
+        WHEN 'critical' THEN 1 WHEN 'high' THEN 2
+        WHEN 'medium' THEN 3 WHEN 'low' THEN 4 ELSE 5 END)
+
+  - name: incidents_by_org
+    description: Incident volume per organization
+    sql: |-
+      SELECT organization_name,
+             COUNT(*) AS total_incidents,
+             COUNT(*) FILTER (WHERE severity = 'critical') AS critical_count,
+             COUNT(*) FILTER (WHERE status NOT IN ('resolved', 'closed')) AS open_count
+      FROM incidents
+      GROUP BY organization_name
+      ORDER BY total_incidents DESC
+
+  - name: incident_trend
+    description: Monthly incident trend
+    sql: |-
+      SELECT TO_CHAR(created_at, 'YYYY-MM') AS month,
+             COUNT(*) AS incident_count,
+             COUNT(*) FILTER (WHERE severity IN ('critical', 'high')) AS high_sev_count
+      FROM incidents
+      GROUP BY month
+      ORDER BY month

package/templates/nextjs-standalone/data/cybersec-semantic/entities/organizations.yml

@@ -0,0 +1,136 @@
+name: Organizations
+type: dimension_table
+table: organizations
+grain: one row per customer organization
+description: |
+  Customer organizations using the Sentinel Security platform. Contains
+  firmographic data including industry vertical, company size tier, country,
+  domain, and active status. Each organization can have multiple users, assets,
+  subscriptions, scans, incidents, and compliance assessments. This is the
+  central dimension table for customer-level analysis and security posture
+  comparison.
+
+dimensions:
+  - name: id
+    sql: id
+    type: number
+    description: Primary key — unique organization identifier
+    primary_key: true
+
+  - name: name
+    sql: name
+    type: string
+    description: Organization name
+    sample_values: [Acme Industries, NovaTech Solutions, GlobalBank Corp, HealthFirst Inc]
+
+  - name: industry
+    sql: industry
+    type: string
+    description: Business sector / vertical
+    sample_values: [Technology, Finance, Healthcare, Manufacturing, Retail, Energy, Government, Education]
+
+  - name: size_tier
+    sql: size_tier
+    type: string
+    description: Organization size classification based on employee count
+    sample_values: [small, medium, large, enterprise]
+
+  - name: domain
+    sql: domain
+    type: string
+    description: Primary domain name of the organization
+
+  - name: country
+    sql: country
+    type: string
+    description: Country where the organization is headquartered
+    sample_values: [US, UK, DE, CA, AU, JP, SG, FR, BR, IN]
+
+  - name: created_at
+    sql: created_at
+    type: timestamp
+    description: When the organization was onboarded to the platform
+
+  - name: updated_at
+    sql: updated_at
+    type: timestamp
+    description: Last time the organization record was modified
+
+  - name: is_active
+    sql: is_active
+    type: boolean
+    description: Whether the organization is currently active on the platform
+
+  - name: created_year
+    sql: EXTRACT(YEAR FROM created_at)
+    type: number
+    description: Year the organization was onboarded — useful for cohort analysis
+    virtual: true
+
+  - name: created_month
+    sql: TO_CHAR(created_at, 'YYYY-MM')
+    type: string
+    description: Year-month the organization was onboarded
+    virtual: true
+
+  - name: size_category
+    sql: |-
+      CASE
+        WHEN size_tier IN ('small', 'medium') THEN 'SMB'
+        WHEN size_tier = 'large' THEN 'Mid-Market'
+        WHEN size_tier = 'enterprise' THEN 'Enterprise'
+        ELSE 'Unknown'
+      END
+    type: string
+    description: Simplified size grouping for segmentation (SMB / Mid-Market / Enterprise)
+    virtual: true
+    sample_values: [SMB, Mid-Market, Enterprise]
+
+measures:
+  - name: org_count
+    sql: id
+    type: count_distinct
+    description: Number of unique organizations
+
+  - name: active_org_count
+    sql: CASE WHEN is_active THEN id END
+    type: count_distinct
+    description: Number of active organizations
+
+use_cases:
+  - Customer segmentation by industry, size tier, and geography
+  - Organization-level security posture comparison
+  - Customer onboarding cohort analysis
+  - Active vs inactive customer analysis
+  - Join to subscriptions for revenue-per-organization analysis
+
+query_patterns:
+  - name: orgs_by_industry
+    description: Customer count by industry vertical
+    sql: |-
+      SELECT industry,
+             COUNT(*) AS org_count,
+             COUNT(*) FILTER (WHERE is_active) AS active_count
+      FROM organizations
+      GROUP BY industry
+      ORDER BY org_count DESC
+
+  - name: orgs_by_size_tier
+    description: Organization distribution by size tier
+    sql: |-
+      SELECT size_tier,
+             COUNT(*) AS org_count,
+             COUNT(*) FILTER (WHERE is_active) AS active_count
+      FROM organizations
+      GROUP BY size_tier
+      ORDER BY org_count DESC
+
+  - name: orgs_by_country
+    description: Customer distribution by country
+    sql: |-
+      SELECT country,
+             COUNT(*) AS org_count
+      FROM organizations
+      WHERE is_active = true
+      GROUP BY country
+      ORDER BY org_count DESC