@x12i/memorix-retrieval 1.1.0

package/catalox-seeds/inputs/entity-descriptors/vulnerabilities.json

@@ -0,0 +1,419 @@
+{
+  "id": "vulnerabilities",
+  "entityName": "vulnerabilities",
+  "target": "event",
+  "collectionPrefix": "vulnerabilities",
+  "identity": {
+    "allowedIdFields": [
+      "entityId",
+      "eventId"
+    ],
+    "requiredExactlyOne": true,
+    "defaultIdField": "entityId"
+  },
+  "defaults": {
+    "canonicalContentType": "snapshots",
+    "dataRoot": "data",
+    "effectiveDatePath": "capturedAt",
+    "fallbackEffectiveDatePaths": [
+      "snapshot.capturedAt",
+      "data.enrichment.enrichedAt"
+    ]
+  },
+  "contentTypes": {
+    "snapshots": {
+      "postfix": "snapshots",
+      "collection": "vulnerabilities-snapshots",
+      "dataRoot": "data",
+      "isCanonical": true,
+      "effectiveDatePath": "capturedAt",
+      "fallbackEffectiveDatePaths": [
+        "snapshot.capturedAt",
+        "data.enrichment.enrichedAt"
+      ]
+    }
+  },
+  "properties": {
+    "vulnerabilityId": {
+      "label": "Vulnerability ID",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.vulnerabilityId"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "assetIp": {
+      "label": "Asset IP",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.assetIp"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "assetType": {
+      "label": "Asset Type",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.assetType"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "assetZone": {
+      "label": "Asset Zone",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.assetZone"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "assetHostname": {
+      "label": "Asset Hostname",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.assetHostname"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "pluginId": {
+      "label": "Plugin ID",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.pluginId"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "pluginName": {
+      "label": "Plugin Name",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.pluginName"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "pluginFamily": {
+      "label": "Plugin Family",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.pluginFamily"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "severity": {
+      "label": "Severity",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.severity"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "severityLevel": {
+      "label": "Severity Level",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.severityLevel"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "cveIds": {
+      "label": "CVEs",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.cveIds"
+      },
+      "humanReadable": true,
+      "sortable": false,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "array"
+    },
+    "riskLevel": {
+      "label": "Risk Level",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.enrichment.riskLevel"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "priorityScore": {
+      "label": "Priority Score",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.enrichment.priorityScore"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "compositeScore": {
+      "label": "Composite Score",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.enrichment.compositeScore"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "epss": {
+      "label": "EPSS",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.enrichment.epss.epss"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "epssPercentile": {
+      "label": "EPSS Percentile",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.enrichment.epss.percentile"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "knownExploited": {
+      "label": "Known Exploited",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.enrichment.kev.isKnownExploited"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "boolean"
+    },
+    "cvssBaseScore": {
+      "label": "CVSS Base Score",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.enrichment.cvss.baseScore"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "cvssVector": {
+      "label": "CVSS Vector",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.enrichment.cvss.cvssVector"
+      },
+      "humanReadable": true,
+      "sortable": false,
+      "filterable": true,
+      "list": false,
+      "item": true,
+      "valueType": "string"
+    },
+    "exploitabilityScore": {
+      "label": "Exploitability Score",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.exploitabilityScore"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "exploitabilityLevel": {
+      "label": "Exploitability Level",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.exploitabilityLevel"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "assetMatched": {
+      "label": "Asset Matched",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.assetMatched"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": false,
+      "item": true,
+      "valueType": "boolean"
+    },
+    "networkExposure": {
+      "label": "Network Exposure",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.mitreAnalysis.networkContext.exposure"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "attackPathCount": {
+      "label": "Attack Path Count",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.mitreAnalysis.networkContext.paths.paths"
+      },
+      "humanReadable": true,
+      "sortable": false,
+      "filterable": false,
+      "list": false,
+      "item": true,
+      "valueType": "array"
+    },
+    "mitreTechniques": {
+      "label": "MITRE Techniques",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.mitreAnalysis.techniques"
+      },
+      "humanReadable": true,
+      "sortable": false,
+      "filterable": true,
+      "list": false,
+      "item": true,
+      "valueType": "array"
+    },
+    "mitreAnalysis": {
+      "label": "MITRE Analysis",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.mitreAnalysis"
+      },
+      "humanReadable": false,
+      "sortable": false,
+      "filterable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    }
+  },
+  "relations": {
+    "affectedAsset": {
+      "targetEntity": "assets",
+      "type": "manyToOne",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.assetIp"
+      },
+      "target": {
+        "contentType": "snapshots",
+        "path": "data.ip_address"
+      },
+      "defaultMode": "extendFields",
+      "targetFields": [
+        "ipAddress",
+        "hostName",
+        "xdrOperationalStatus",
+        "xdrAgentStatus",
+        "potentialImpactLevel"
+      ]
+    },
+    "vulnerabilityGroup": {
+      "targetEntity": "variabilities-groups",
+      "type": "manyToOne",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.pluginId"
+      },
+      "target": {
+        "contentType": "snapshots",
+        "path": "data.plugin_id"
+      },
+      "defaultMode": "extendFields",
+      "targetFields": [
+        "groupId",
+        "pluginName",
+        "severityLevel",
+        "affectedEntitiesCount",
+        "riskLevel",
+        "priorityScore"
+      ]
+    }
+  }
+}

package/catalox-seeds/inputs/item-descriptors/asset-detail-item.json

@@ -0,0 +1,85 @@
+{
+  "id": "asset-detail-item",
+  "entity": "assets",
+  "title": "Asset Detail",
+  "identity": {
+    "idField": "entityId"
+  },
+  "contentTypes": [
+    {
+      "contentType": "snapshots",
+      "required": true,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": [
+          "snapshot.capturedAt",
+          "data.xdr.last_seen"
+        ]
+      }
+    }
+  ],
+  "sections": [
+    {
+      "id": "summary",
+      "title": "Summary",
+      "fields": [
+        "ipAddress",
+        "hostName",
+        "source",
+        "agentType",
+        "xdrOperationalStatus",
+        "xdrAgentStatus",
+        "lastSeen",
+        "pathsCount"
+      ]
+    },
+    {
+      "id": "vulnerabilitySummary",
+      "title": "Vulnerability Summary",
+      "fields": [
+        "hasVulnerabilities",
+        "criticalVulnerabilities",
+        "highVulnerabilities",
+        "mediumVulnerabilities",
+        "lowVulnerabilities"
+      ]
+    },
+    {
+      "id": "impact",
+      "title": "Potential Impact",
+      "fields": [
+        "potentialImpactLevel",
+        "potentialImpactConfidence",
+        "potentialImpactStory"
+      ]
+    },
+    {
+      "id": "xdr",
+      "title": "XDR",
+      "fields": [
+        "users",
+        "rawXdr"
+      ]
+    }
+  ],
+  "includeRelations": [
+    {
+      "relation": "assetVulnerabilities",
+      "mode": "array",
+      "arrayProperty": "vulnerabilities",
+      "limit": 100,
+      "fields": [
+        "vulnerabilityId",
+        "pluginName",
+        "severityLevel",
+        "riskLevel",
+        "priorityScore",
+        "cveIds"
+      ]
+    }
+  ],
+  "content": {
+    "allowed": false
+  }
+}

package/catalox-seeds/inputs/item-descriptors/variabilities-group-detail-item.json

@@ -0,0 +1,87 @@
+{
+  "id": "variabilities-group-detail-item",
+  "entity": "variabilities-groups",
+  "title": "Vulnerability Group Detail",
+  "identity": {
+    "idField": "entityId"
+  },
+  "contentTypes": [
+    {
+      "contentType": "snapshots",
+      "required": true,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": [
+          "snapshot.capturedAt",
+          "data.enrichedAt",
+          "data.enrichment.enrichedAt"
+        ]
+      }
+    }
+  ],
+  "sections": [
+    {
+      "id": "summary",
+      "title": "Summary",
+      "fields": [
+        "groupId",
+        "type",
+        "pluginId",
+        "pluginName",
+        "pluginFamily",
+        "severity",
+        "severityLevel",
+        "cveIds",
+        "source"
+      ]
+    },
+    {
+      "id": "affectedEntities",
+      "title": "Affected Entities",
+      "fields": [
+        "affectedEntities",
+        "affectedEntitiesCount"
+      ]
+    },
+    {
+      "id": "risk",
+      "title": "Risk",
+      "fields": [
+        "riskLevel",
+        "priorityScore",
+        "compositeScore"
+      ]
+    },
+    {
+      "id": "threatIntelligence",
+      "title": "Threat Intelligence",
+      "fields": [
+        "epss",
+        "knownExploited",
+        "cvssBaseScore",
+        "cvssVector",
+        "enrichedAt"
+      ]
+    }
+  ],
+  "includeRelations": [
+    {
+      "relation": "groupVulnerabilities",
+      "mode": "array",
+      "arrayProperty": "vulnerabilities",
+      "limit": 200,
+      "fields": [
+        "vulnerabilityId",
+        "assetIp",
+        "pluginName",
+        "severityLevel",
+        "riskLevel",
+        "priorityScore"
+      ]
+    }
+  ],
+  "content": {
+    "allowed": false
+  }
+}

package/catalox-seeds/inputs/item-descriptors/vulnerability-detail-item.json

@@ -0,0 +1,106 @@
+{
+  "id": "vulnerability-detail-item",
+  "entity": "vulnerabilities",
+  "title": "Vulnerability Detail",
+  "identity": {
+    "idField": "entityId"
+  },
+  "contentTypes": [
+    {
+      "contentType": "snapshots",
+      "required": true,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": [
+          "snapshot.capturedAt",
+          "data.enrichment.enrichedAt"
+        ]
+      }
+    }
+  ],
+  "sections": [
+    {
+      "id": "summary",
+      "title": "Summary",
+      "fields": [
+        "vulnerabilityId",
+        "pluginName",
+        "pluginFamily",
+        "severity",
+        "severityLevel",
+        "cveIds"
+      ]
+    },
+    {
+      "id": "asset",
+      "title": "Affected Asset",
+      "fields": [
+        "assetIp",
+        "assetType",
+        "assetZone",
+        "assetHostname",
+        "assetMatched"
+      ]
+    },
+    {
+      "id": "risk",
+      "title": "Risk",
+      "fields": [
+        "riskLevel",
+        "priorityScore",
+        "compositeScore",
+        "exploitabilityScore",
+        "exploitabilityLevel"
+      ]
+    },
+    {
+      "id": "threatIntelligence",
+      "title": "Threat Intelligence",
+      "fields": [
+        "epss",
+        "epssPercentile",
+        "knownExploited",
+        "cvssBaseScore",
+        "cvssVector"
+      ]
+    },
+    {
+      "id": "networkAndMitre",
+      "title": "Network & MITRE",
+      "fields": [
+        "networkExposure",
+        "mitreTechniques",
+        "mitreAnalysis"
+      ]
+    }
+  ],
+  "includeRelations": [
+    {
+      "relation": "affectedAsset",
+      "mode": "extendFields",
+      "fields": [
+        "ipAddress",
+        "hostName",
+        "xdrOperationalStatus",
+        "xdrAgentStatus",
+        "potentialImpactLevel"
+      ]
+    },
+    {
+      "relation": "vulnerabilityGroup",
+      "mode": "extendFields",
+      "fields": [
+        "groupId",
+        "pluginName",
+        "severityLevel",
+        "affectedEntitiesCount",
+        "riskLevel",
+        "priorityScore"
+      ]
+    }
+  ],
+  "content": {
+    "allowed": false
+  }
+}