@x12i/memorix-retrieval 1.29.0 → 1.31.0

package/catalox-seeds/inputs/entity-descriptors/assets.json

@@ -35,6 +35,12 @@
         "snapshot.capturedAt",
         "data.lastSeen"
       ]
+    },
+    "scoped": {
+      "postfix": "scoped",
+      "collection": "assets-scoped",
+      "dataRoot": "data",
+      "isCanonical": false
     }
   },
   "properties": {
@@ -42,7 +48,7 @@
       "label": "IP Address",
       "source": {
         "contentType": "snapshots",
-        "path": "data.ip_address"
+        "path": "data.assetIp"
       },
       "humanReadable": true,
       "sortable": true,
@@ -51,31 +57,31 @@
       "item": true,
       "valueType": "string"
     },
-    "subnetIp": {
-      "label": "Subnet IP",
+    "subnetCidrs": {
+      "label": "Subnet CIDRs",
       "source": {
         "contentType": "snapshots",
-        "path": "data.subnetIp"
+        "path": "data.subnetCidrs"
       },
       "humanReadable": true,
-      "sortable": true,
+      "sortable": false,
       "filterable": true,
-      "list": true,
+      "list": false,
       "item": true,
-      "valueType": "string"
+      "valueType": "array"
     },
-    "subnetCidr": {
-      "label": "Subnet CIDR",
+    "subnets": {
+      "label": "Resolved Subnets",
       "source": {
         "contentType": "snapshots",
-        "path": "data.subnetCidr"
+        "path": "data.subnets"
       },
-      "humanReadable": true,
-      "sortable": true,
-      "filterable": true,
+      "humanReadable": false,
+      "sortable": false,
+      "filterable": false,
       "list": false,
       "item": true,
-      "valueType": "string"
+      "valueType": "array"
     },
     "source": {
       "label": "Source",
@@ -155,19 +161,6 @@
       "item": true,
       "valueType": "datetime"
     },
-    "hasVulnerabilities": {
-      "label": "Has Vulnerabilities",
-      "source": {
-        "contentType": "snapshots",
-        "path": "data.hasVulnerabilities"
-      },
-      "humanReadable": true,
-      "sortable": true,
-      "filterable": true,
-      "list": true,
-      "item": true,
-      "valueType": "boolean"
-    },
     "criticalVulnerabilities": {
       "label": "Critical Vulnerabilities",
       "source": {
@@ -294,24 +287,137 @@
       "valueShape": "array<object>",
       "linkedObjectType": "subnets",
       "linkedContentType": "snapshots",
-      "description": "Subnet snapshot payloads copied from subnets-snapshots.data when asset data.subnetCidrs matches subnet data.cidr.",
+      "description": "Subnet snapshot payloads copied from subnets-snapshots.data when asset data.subnetCidrs matches subnet data.cidr. Each item includes linked recordId.",
       "managed": true,
       "refreshRuleKey": "assets.subnets.snapshots.by-cidr",
       "sourceCollection": "subnets-snapshots"
     },
     {
-      "name": "associatedInferred",
+      "name": "associatedDiscovery",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "subnets",
+      "linkedContentType": "discovery",
+      "description": "Subnet discovery payloads copied from subnets-discovery.data when asset data.subnetCidrs matches subnet data.cidr.",
+      "managed": true,
+      "refreshRuleKey": "assets.subnets.discovery.by-cidr",
+      "sourceCollection": "subnets-discovery"
+    },
+    {
+      "name": "associatedSiblings",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "assets",
+      "linkedContentType": "snapshots",
+      "description": "Root-level self-association: other asset snapshot data payloads sharing a data.subnetCidr value. Each item includes linked recordId. Capped at 99 items.",
+      "managed": true,
+      "refreshRuleKey": "assets.assets.snapshots.by-cidr",
+      "sourceCollection": "assets-snapshots"
+    },
+    {
+      "name": "associatedTopology",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "subnets",
+      "linkedContentType": "snapshots",
+      "description": "Normalized subnet topology objects derived from associatedData and canonical subnet lookup. Each item includes kind, source, cidr, zone, vr, and exposure/reachability fields. subnetId is omitted.",
+      "managed": true,
+      "refreshRuleKey": "assets.associated-topology.by-associated-data",
+      "sourceCollection": "subnets-snapshots"
+    },
+    {
+      "name": "associatedSubnets",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
       "linkedObjectType": "subnets",
-      "linkedContentType": "inferences",
-      "description": "Subnet discovery payloads copied from subnets-inferences.data when asset data.subnetCidrs matches subnet data.cidr.",
+      "linkedContentType": "snapshots",
+      "description": "Explicit subnet snapshot payloads copied from subnets-snapshots.data when asset data.subnetCidrs matches subnet data.cidr.",
       "managed": true,
-      "refreshRuleKey": "assets.subnets.inferences.by-cidr",
-      "sourceCollection": "subnets-inferences"
+      "refreshRuleKey": "assets.subnets.snapshots.explicit.by-cidr",
+      "sourceCollection": "subnets-snapshots"
+    },
+    {
+      "name": "associatedSubnetsDiscovery",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "subnets",
+      "linkedContentType": "discovery",
+      "description": "Explicit subnet discovery payloads copied from subnets-discovery when asset data.subnetCidrs matches subnet CIDR.",
+      "managed": true,
+      "refreshRuleKey": "assets.subnets.discovery.explicit.by-cidr",
+      "sourceCollection": "subnets-discovery"
+    },
+    {
+      "name": "associatedSubnetsAnalysis",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "subnets",
+      "linkedContentType": "analysis",
+      "description": "Explicit subnet analysis payloads copied from subnets-analysis when asset data.subnetCidrs matches subnet CIDR.",
+      "managed": true,
+      "refreshRuleKey": "assets.subnets.analysis.explicit.by-cidr",
+      "sourceCollection": "subnets-analysis"
     }
   ],
+  "processing": {
+    "entityRoutes": [
+      {
+        "routeKey": "subnets-to-assets",
+        "parentObjectType": "subnets",
+        "childObjectType": "assets",
+        "relationshipName": "assetSubnet",
+        "direction": "parentToChild",
+        "source": {
+          "contentType": "snapshots",
+          "path": "data.subnetCidrs"
+        },
+        "target": {
+          "contentType": "snapshots",
+          "path": "data.cidr"
+        }
+      }
+    ],
+    "resolvers": [
+      {
+        "processorId": "assets.subnet-cidr",
+        "resolverType": "subnet-cidr",
+        "kind": "function",
+        "config": {
+          "mode": "resolve",
+          "assetIpPaths": ["data.assetIps", "data.assetIp"],
+          "canonicalCollection": {
+            "db": "neo-memorix-entities",
+            "collection": "subnets-snapshots"
+          }
+        }
+      }
+    ],
+    "associatedContent": {
+      "rollParentSnapshots": true,
+      "excludePostfixes": ["raw"]
+    }
+  },
+  "narratives": {
+    "has-vulnerabilities": {
+      "label": "Has vulnerabilities",
+      "kind": "having-signal",
+      "sourceRef": "assetVulnerabilities",
+      "targetEntity": "vulnerabilities"
+    },
+    "has-medium-vulnerabilities": {
+      "kind": "association-common-property",
+      "sourceRef": "assetVulnerabilities",
+      "targetEntity": "vulnerabilities",
+      "property": "severity",
+      "value": "medium"
+    }
+  },
   "relations": {
     "assetSubnet": {
       "targetEntity": "subnets",
@@ -328,7 +434,9 @@
       "defaultArrayProperty": "associatedData",
       "targetFields": [
         "cidr",
-        "subnetIp",
+        "networkAddress",
+        "prefixLength",
+        "mask",
         "zone",
         "vr"
       ]

package/catalox-seeds/inputs/entity-descriptors/subnets.json

@@ -29,14 +29,9 @@
       "collection": "subnets-snapshots",
       "isCanonical": true
     },
-    "core": {
-      "postfix": "core",
-      "collection": "subnets-core",
-      "isCanonical": false
-    },
-    "inferences": {
-      "postfix": "inferences",
-      "collection": "subnets-inferences",
+    "discovery": {
+      "postfix": "discovery",
+      "collection": "subnets-discovery",
       "isCanonical": false
     },
     "scoped": {
@@ -50,6 +45,18 @@
       "isCanonical": false
     }
   },
+  "rootProperties": {
+    "possiblePaths": {
+      "label": "Possible Paths",
+      "source": {
+        "contentType": "snapshots",
+        "path": "possiblePaths"
+      },
+      "valueShape": "object",
+      "description": "Subnet-specific topology path facts stored at the snapshot root.",
+      "managed": true
+    }
+  },
   "properties": {
     "recordId": {
       "label": "Record ID",
@@ -77,11 +84,11 @@
       "item": true,
       "valueType": "string"
     },
-    "subnetIp": {
-      "label": "Subnet network address",
+    "networkAddress": {
+      "label": "Network Address",
       "source": {
         "contentType": "snapshots",
-        "path": "data.subnetIp"
+        "path": "data.networkAddress"
       },
       "humanReadable": true,
       "sortable": true,
@@ -90,6 +97,32 @@
       "item": true,
       "valueType": "string"
     },
+    "prefixLength": {
+      "label": "Prefix Length",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.prefixLength"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": false,
+      "item": true,
+      "valueType": "number"
+    },
+    "mask": {
+      "label": "Subnet Mask",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.mask"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": false,
+      "item": true,
+      "valueType": "string"
+    },
     "zone": {
       "label": "Zone",
       "source": {
@@ -260,5 +293,65 @@
       "valueType": "string"
     }
   },
+  "associatedProperties": [
+    {
+      "name": "associatedChildren",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "assets",
+      "linkedContentType": "snapshots",
+      "description": "Asset snapshot data payloads whose data.subnetCidrs contains this subnet data.cidr. Each item includes linked recordId. Capped at 99 items.",
+      "managed": true,
+      "refreshRuleKey": "subnets.assets.snapshots.by-cidr",
+      "sourceCollection": "assets-snapshots"
+    }
+  ],
+  "processing": {
+    "entityRoutes": [
+      {
+        "routeKey": "zones-to-subnets",
+        "parentObjectType": "topology-zones",
+        "childObjectType": "subnets",
+        "relationshipName": "subnetZone",
+        "direction": "parentToChild",
+        "source": {
+          "contentType": "snapshots",
+          "path": "data.zone"
+        },
+        "target": {
+          "contentType": "snapshots",
+          "path": "data.name"
+        }
+      }
+    ],
+    "insightStages": [
+      {
+        "processorId": "network.cidr-topology-path-resolver",
+        "kind": "function",
+        "inputKind": "cidr",
+        "outputKind": "cidr-path-facts",
+        "writeToInsights": false,
+        "sources": {
+          "topologyDb": "memorix-knowledge",
+          "topologyCollection": "topology-raw"
+        }
+      },
+      {
+        "processorId": "network.cidr-zone-path-insights",
+        "kind": "function",
+        "inputKind": "cidr-path-facts",
+        "outputKind": "insights",
+        "writeToInsights": true,
+        "sources": {
+          "zonesCollection": "topology-zones-snapshots"
+        }
+      }
+    ],
+    "associatedContent": {
+      "rollParentSnapshots": true,
+      "excludePostfixes": ["raw"]
+    }
+  },
   "relations": {}
 }

package/catalox-seeds/inputs/entity-descriptors/vulnerabilities-groups.json

@@ -30,9 +30,9 @@
       "dataRoot": "data",
       "isCanonical": true
     },
-    "inferences": {
-      "postfix": "inferences",
-      "collection": "vulnerabilities-groups-inferences",
+    "discovery": {
+      "postfix": "discovery",
+      "collection": "vulnerabilities-groups-discovery",
       "dataRoot": "data",
       "isCanonical": false
     },
@@ -111,6 +111,12 @@
     }
   },
   "associatedProperties": [],
+  "processing": {
+    "associatedContent": {
+      "rollParentSnapshots": false,
+      "excludePostfixes": ["raw"]
+    }
+  },
   "relations": {
     "groupVulnerabilities": {
       "targetEntity": "vulnerabilities",

package/catalox-seeds/inputs/entity-descriptors/vulnerabilities.json

@@ -64,6 +64,19 @@
       "item": true,
       "valueType": "string"
     },
+    "subnetIp": {
+      "label": "Subnet IP",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.subnetIp"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
     "assetType": {
       "label": "Asset Type",
       "source": {
@@ -378,16 +391,16 @@
       "sourceCollection": "vulnerabilities-groups-snapshots"
     },
     {
-      "name": "associatedInferred",
+      "name": "associatedDiscovery",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
       "linkedObjectType": "vulnerabilities-groups",
-      "linkedContentType": "inferences",
-      "description": "Vulnerability group discovery payloads copied from vulnerabilities-groups-inferences.data via group name bridge.",
+      "linkedContentType": "discovery",
+      "description": "Vulnerability group discovery payloads copied from vulnerabilities-groups-discovery.data via group name bridge.",
       "managed": true,
-      "refreshRuleKey": "vulnerabilities.vulnerability-groups.inferences.by-name",
-      "sourceCollection": "vulnerabilities-groups-inferences"
+      "refreshRuleKey": "vulnerabilities.vulnerability-groups.discovery.by-name",
+      "sourceCollection": "vulnerabilities-groups-discovery"
     },
     {
       "name": "associatedAnalysis",
@@ -408,12 +421,114 @@
       "valueShape": "array<object>",
       "linkedObjectType": "assets",
       "linkedContentType": "snapshots",
-      "description": "Optional asset snapshot payloads copied from assets-snapshots.data when data.assetIp matches asset data.assetIps.",
+      "description": "Optional asset snapshot payloads copied from assets-snapshots.data when data.assetIp exactly matches asset data.assetIps, data.assetIp, or legacy data.ip_address. At most one item per vulnerability.",
       "managed": true,
       "refreshRuleKey": "vulnerabilities.assets.snapshots.by-assetIp",
       "sourceCollection": "assets-snapshots"
+    },
+    {
+      "name": "associatedTopology",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "subnets",
+      "linkedContentType": "snapshots",
+      "description": "Normalized subnet topology objects from associatedData roll-down and canonical subnet lookup by data.assetIp. May contain both associatedData and subnetLookup sources for the same CIDR.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.associated-topology.by-associated-data-and-subnet-lookup",
+      "sourceCollection": "subnets-snapshots"
+    },
+    {
+      "name": "associatedVulnerabilityGroup",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities-groups",
+      "linkedContentType": "snapshots",
+      "description": "Explicit vulnerability group snapshot payloads copied from vulnerabilities-groups-snapshots.data when data.vulnerabilityName matches group data.name.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerability-groups.snapshots.explicit.by-name",
+      "sourceCollection": "vulnerabilities-groups-snapshots"
+    },
+    {
+      "name": "associatedVulnerabilityGroupDiscovery",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities-groups",
+      "linkedContentType": "discovery",
+      "description": "Explicit vulnerability group discovery payloads copied from vulnerabilities-groups-discovery via group name bridge.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerability-groups.discovery.explicit.by-name",
+      "sourceCollection": "vulnerabilities-groups-discovery"
+    },
+    {
+      "name": "associatedVulnerabilityGroupAnalysis",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities-groups",
+      "linkedContentType": "analysis",
+      "description": "Explicit vulnerability group analysis payloads copied from vulnerabilities-groups-analysis via group name bridge.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerability-groups.analysis.explicit.by-name",
+      "sourceCollection": "vulnerabilities-groups-analysis"
     }
   ],
+  "processing": {
+    "entityRoutes": [
+      {
+        "routeKey": "groups-to-vulnerabilities",
+        "parentObjectType": "vulnerabilities-groups",
+        "childObjectType": "vulnerabilities",
+        "relationshipName": "vulnerabilityGroup",
+        "direction": "parentToChild",
+        "source": {
+          "contentType": "snapshots",
+          "path": "data.vulnerabilityName"
+        },
+        "target": {
+          "contentType": "snapshots",
+          "path": "data.name"
+        },
+        "prerequisites": [
+          {
+            "parentObjectType": "vulnerabilities-groups",
+            "parentContentPostfix": "analysis",
+            "lifecycleProcess": "entity-insights-processed",
+            "onMissing": "defer"
+          }
+        ]
+      },
+      {
+        "routeKey": "assets-to-vulnerabilities",
+        "parentObjectType": "assets",
+        "childObjectType": "vulnerabilities",
+        "relationshipName": "affectedAsset",
+        "direction": "parentToChild",
+        "source": {
+          "contentType": "snapshots",
+          "path": "data.assetIp"
+        },
+        "target": {
+          "contentType": "snapshots",
+          "path": "data.assetIps"
+        }
+      }
+    ],
+    "associatedContent": {
+      "rollParentSnapshots": true,
+      "excludePostfixes": ["raw"]
+    }
+  },
+  "narratives": {
+    "has-assets": {
+      "label": "Has assets",
+      "kind": "having-signal",
+      "sourceRef": "affectedAsset",
+      "targetEntity": "assets"
+    }
+  },
   "relations": {
     "affectedAsset": {
       "targetEntity": "assets",

package/catalox-seeds/inputs/item-descriptors/asset-detail-item.json

@@ -41,7 +41,6 @@
       "id": "vulnerabilitySummary",
       "title": "Vulnerability Summary",
       "fields": [
-        "hasVulnerabilities",
         "criticalVulnerabilities",
         "highVulnerabilities",
         "mediumVulnerabilities",

package/catalox-seeds/inputs/item-descriptors/vulnerability-detail-item.json

@@ -37,6 +37,7 @@
       "title": "Affected Asset",
       "fields": [
         "assetIp",
+        "subnetIp",
         "assetType",
         "assetZone",
         "assetHostname",

package/catalox-seeds/inputs/list-descriptors/assets-main-list.json

@@ -18,7 +18,6 @@
     "agentType",
     "xdrOperationalStatus",
     "xdrAgentStatus",
-    "hasVulnerabilities",
     "criticalVulnerabilities",
     "highVulnerabilities",
     "potentialImpactLevel",
@@ -35,7 +34,6 @@
     "agentType",
     "xdrOperationalStatus",
     "xdrAgentStatus",
-    "hasVulnerabilities",
     "criticalVulnerabilities",
     "highVulnerabilities",
     "potentialImpactLevel",

package/catalox-seeds/inputs/list-descriptors/vulnerabilities-main-list.json

@@ -12,6 +12,7 @@
   "fields": [
     "vulnerabilityId",
     "assetIp",
+    "subnetIp",
     "pluginName",
     "pluginFamily",
     "severity",
@@ -28,6 +29,7 @@
   "allowedSorts": [
     "vulnerabilityId",
     "assetIp",
+    "subnetIp",
     "pluginName",
     "pluginFamily",
     "severity",