@x12i/memorix-retrieval 1.30.0 → 1.32.0

package/catalox-seeds/inputs/entity-descriptors/assets.json

@@ -41,6 +41,18 @@
       "collection": "assets-scoped",
       "dataRoot": "data",
       "isCanonical": false
+    },
+    "analysis": {
+      "postfix": "analysis",
+      "collection": "assets-analysis",
+      "dataRoot": "data",
+      "isCanonical": false
+    },
+    "decisions": {
+      "postfix": "decision",
+      "collection": "assets-decision",
+      "dataRoot": "data",
+      "isCanonical": false
     }
   },
   "properties": {
@@ -161,19 +173,6 @@
       "item": true,
       "valueType": "datetime"
     },
-    "hasVulnerabilities": {
-      "label": "Has Vulnerabilities",
-      "source": {
-        "contentType": "snapshots",
-        "path": "data.hasVulnerabilities"
-      },
-      "humanReadable": true,
-      "sortable": true,
-      "filterable": true,
-      "list": true,
-      "item": true,
-      "valueType": "boolean"
-    },
     "criticalVulnerabilities": {
       "label": "Critical Vulnerabilities",
       "source": {
@@ -226,6 +225,20 @@
       "item": true,
       "valueType": "number"
     },
+    "findingsCount": {
+      "label": "Findings",
+      "source": {
+        "contentType": "snapshots",
+        "path": "analytics.findings.total"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number",
+      "format": "count"
+    },
     "potentialImpactLevel": {
       "label": "Potential Impact",
       "source": {
@@ -290,11 +303,146 @@
       "list": false,
       "item": true,
       "valueType": "object"
+    },
+    "observedUsers": {
+      "label": "Users",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.observedUsers"
+      },
+      "humanReadable": true,
+      "sortable": false,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "array"
+    },
+    "analysisBriefSummary": {
+      "label": "Brief Summary",
+      "source": { "contentType": "analysis", "path": "data.brief.summary" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisBriefTakeaway": {
+      "label": "Brief Takeaway",
+      "source": { "contentType": "analysis", "path": "data.brief.takeaway" },
+      "humanReadable": true,
+      "list": false,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisBriefConfidence": {
+      "label": "Brief Confidence",
+      "source": { "contentType": "analysis", "path": "data.brief.confidence" },
+      "humanReadable": true,
+      "list": false,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisContext": {
+      "label": "Context",
+      "source": { "contentType": "analysis", "path": "data.context" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisReachability": {
+      "label": "Reachability",
+      "source": { "contentType": "analysis", "path": "data.reachability" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisPaths": {
+      "label": "Paths",
+      "source": { "contentType": "analysis", "path": "data.paths" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "attackPathExistence": {
+      "label": "Attack Path Existence",
+      "source": { "contentType": "analysis", "path": "data.paths.attackPathExistence" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "decisionOverviewSummary": {
+      "label": "Decision Summary",
+      "source": { "contentType": "decisions", "path": "data.overview.summary" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "decisionOverviewDetailedAnalysis": {
+      "label": "Decision Detailed Analysis",
+      "source": { "contentType": "decisions", "path": "data.overview.detailedAnalysis" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "decisionExploitability": {
+      "label": "Exploitability Analysis",
+      "source": { "contentType": "decisions", "path": "data.exploitability" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "decisionLabel": {
+      "label": "Decision",
+      "source": { "contentType": "decisions", "path": "data.decision.decision" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "decisionStatus": {
+      "label": "Decision Status",
+      "source": { "contentType": "decisions", "path": "data.decision.status" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "decisionRiskScore": {
+      "label": "Decision Score",
+      "source": { "contentType": "decisions", "path": "data.decision.riskScore" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "decisionUrgencyScore": {
+      "label": "Urgency Score",
+      "source": { "contentType": "decisions", "path": "data.decision.urgencyScore" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
     }
   },
   "associatedProperties": [
     {
-      "name": "associatedData",
+      "name": "associatedSubnetsSnapshots",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -306,19 +454,19 @@
       "sourceCollection": "subnets-snapshots"
     },
     {
-      "name": "associatedInferred",
+      "name": "associatedSubnetsDiscovery",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
       "linkedObjectType": "subnets",
-      "linkedContentType": "inferences",
-      "description": "Subnet discovery payloads copied from subnets-inferences.data when asset data.subnetCidrs matches subnet data.cidr.",
+      "linkedContentType": "discovery",
+      "description": "Subnet discovery payloads copied from subnets-discovery.data when asset data.subnetCidrs matches subnet data.cidr.",
       "managed": true,
-      "refreshRuleKey": "assets.subnets.inferences.by-cidr",
-      "sourceCollection": "subnets-inferences"
+      "refreshRuleKey": "assets.subnets.discovery.by-cidr",
+      "sourceCollection": "subnets-discovery"
     },
     {
-      "name": "associatedSiblings",
+      "name": "associatedAssetsSnapshots",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -328,8 +476,253 @@
       "managed": true,
       "refreshRuleKey": "assets.assets.snapshots.by-cidr",
       "sourceCollection": "assets-snapshots"
+    },
+    {
+      "name": "associatedTopology",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "subnets",
+      "linkedContentType": "snapshots",
+      "description": "Normalized subnet topology objects derived from associatedData and canonical subnet lookup. Each item includes kind, source, cidr, zone, vr, and exposure/reachability fields. subnetId is omitted.",
+      "managed": true,
+      "refreshRuleKey": "assets.associated-topology.by-associated-data",
+      "sourceCollection": "subnets-snapshots"
+    },
+    {
+      "name": "associatedSubnetsSnapshots",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "subnets",
+      "linkedContentType": "snapshots",
+      "description": "Explicit subnet snapshot payloads copied from subnets-snapshots.data when asset data.subnetCidrs matches subnet data.cidr.",
+      "managed": true,
+      "refreshRuleKey": "assets.subnets.snapshots.explicit.by-cidr",
+      "sourceCollection": "subnets-snapshots"
+    },
+    {
+      "name": "associatedSubnetsDiscovery",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "subnets",
+      "linkedContentType": "discovery",
+      "description": "Explicit subnet discovery payloads copied from subnets-discovery when asset data.subnetCidrs matches subnet CIDR.",
+      "managed": true,
+      "refreshRuleKey": "assets.subnets.discovery.explicit.by-cidr",
+      "sourceCollection": "subnets-discovery"
+    },
+    {
+      "name": "associatedSubnetsAnalysis",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "subnets",
+      "linkedContentType": "analysis",
+      "description": "Explicit subnet analysis payloads copied from subnets-analysis when asset data.subnetCidrs matches subnet CIDR.",
+      "managed": true,
+      "refreshRuleKey": "assets.subnets.analysis.explicit.by-cidr",
+      "sourceCollection": "subnets-analysis"
+    },
+    {
+      "name": "associatedTopologyZonesAnalysis",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "topology-zones",
+      "linkedContentType": "analysis",
+      "description": "Zone cyber-analysis payloads joined by host data.zones or associatedTopology.zone to topology-zones-analysis.data.name.",
+      "managed": true,
+      "refreshRuleKey": "assets.topology-zones.analysis.by-zone-name",
+      "sourceCollection": "topology-zones-analysis"
+    },
+    {
+      "name": "associatedVulnerabilitiesAnalysis",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities",
+      "linkedContentType": "analysis",
+      "description": "Vulnerability analysis payloads copied from vulnerabilities-analysis.data after matching vulnerabilities-snapshots by asset IP and resolving content by snapshot recordId.",
+      "managed": true,
+      "refreshRuleKey": "assets.vulnerabilities.analysis.by-assetIp",
+      "sourceCollection": "vulnerabilities-analysis"
+    },
+    {
+      "name": "associatedTopVulnerabilitiesAnalysis",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities",
+      "linkedContentType": "analysis",
+      "description": "Top vulnerability analysis payloads (default 5), ranked by vulnerabilities-snapshots.data.severity after IP match and content resolve by snapshot recordId. Omitted when empty.",
+      "managed": true,
+      "top": true,
+      "maxItems": 5,
+      "refreshRuleKey": "assets.vulnerabilities.analysis.top.by-assetIp",
+      "sourceCollection": "vulnerabilities-analysis"
     }
   ],
+  "processing": {
+    "entityRoutes": [
+      {
+        "routeKey": "subnets-to-assets",
+        "parentObjectType": "subnets",
+        "childObjectType": "assets",
+        "relationshipName": "assetSubnet",
+        "direction": "parentToChild",
+        "source": {
+          "contentType": "snapshots",
+          "path": "data.subnetCidrs"
+        },
+        "target": {
+          "contentType": "snapshots",
+          "path": "data.cidr"
+        }
+      }
+    ],
+    "resolvers": [
+      {
+        "processorId": "assets.subnet-cidr",
+        "resolverType": "subnet-cidr",
+        "kind": "function",
+        "config": {
+          "mode": "resolve",
+          "assetIpPaths": [
+            "data.assetIps",
+            "data.assetIp"
+          ],
+          "canonicalCollection": {
+            "db": "neo-memorix-entities",
+            "collection": "subnets-snapshots"
+          }
+        }
+      },
+      {
+        "processorId": "assets.topology-extractor",
+        "resolverType": "topology-extractor",
+        "kind": "function",
+        "config": {
+          "mode": "from-associated-data",
+          "sourcePaths": [
+            "associatedSubnetsSnapshots"
+          ],
+          "outputPath": "associatedTopology"
+        }
+      }
+    ],
+    "associatedContent": {
+      "rollParentSnapshots": true,
+      "excludePostfixes": [
+        "raw"
+      ]
+    }
+  },
+  "narratives": {
+    "has-vulnerabilities": {
+      "label": "Has vulnerabilities",
+      "displayName": "Has vulnerabilities",
+      "kind": "having-signal",
+      "visibility": "user",
+      "sourceRef": "assetVulnerabilities",
+      "targetEntity": "vulnerabilities"
+    },
+    "has-medium-vulnerabilities": {
+      "label": "Has medium vulnerabilities",
+      "displayName": "Medium vulnerabilities",
+      "kind": "association-common-property",
+      "visibility": "user",
+      "sourceRef": "assetVulnerabilities",
+      "targetEntity": "vulnerabilities",
+      "property": "severity",
+      "value": "medium"
+    },
+    "is-triaged": {
+      "label": "Is triaged",
+      "displayName": "Triaged",
+      "kind": "product-narrative",
+      "visibility": "user"
+    },
+    "has-triage-decision": {
+      "label": "Has triage decision",
+      "displayName": "Has triage decision",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-no-vulnerabilities": {
+      "label": "No vulnerabilities",
+      "displayName": "No vulnerabilities",
+      "kind": "product-narrative",
+      "visibility": "user"
+    },
+    "has-accept-decision": {
+      "label": "Accept",
+      "displayName": "Accept Risk",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-mitigate-decision": {
+      "label": "Mitigate",
+      "displayName": "Mitigate",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-high-or-critical-exploitability": {
+      "label": "High or critical exploitability",
+      "displayName": "High exploitability",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-lateral-movement-risk": {
+      "label": "Lateral movement risk",
+      "displayName": "Lateral movement risk",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-critical-predicted-impact": {
+      "label": "Critical predicted impact",
+      "displayName": "Critical impact",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-high-predicted-impact": {
+      "label": "High predicted impact",
+      "displayName": "High impact",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-medium-predicted-impact": {
+      "label": "Medium predicted impact",
+      "displayName": "Medium impact",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-low-predicted-impact": {
+      "label": "Low predicted impact",
+      "displayName": "Low impact",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-palo-alto-firewall-source": {
+      "label": "Palo Alto Firewall",
+      "displayName": "Palo Alto Firewall",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-palo-alto-xdr-source": {
+      "label": "Palo Alto XDR",
+      "displayName": "Palo Alto XDR",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-tenable-nessus-source": {
+      "label": "Tenable Nessus",
+      "displayName": "Tenable Nessus",
+      "kind": "rollup",
+      "visibility": "user"
+    }
+  },
   "relations": {
     "assetSubnet": {
       "targetEntity": "subnets",
@@ -343,7 +736,7 @@
         "path": "data.cidr"
       },
       "defaultMode": "array",
-      "defaultArrayProperty": "associatedData",
+      "defaultArrayProperty": "associatedSubnetsSnapshots",
       "targetFields": [
         "cidr",
         "networkAddress",