@x12i/memorix-retrieval 1.30.0 → 1.32.0

package/catalox-seeds/inputs/entity-descriptors/vulnerabilities.json

@@ -35,6 +35,21 @@
         "snapshot.capturedAt",
         "data.enrichment.enrichedAt"
       ]
+    },
+    "discovery": {
+      "postfix": "discovery",
+      "collection": "vulnerabilities-discovery",
+      "dataRoot": "data"
+    },
+    "decisions": {
+      "postfix": "decisions",
+      "collection": "vulnerabilities-decisions",
+      "dataRoot": "data"
+    },
+    "analysis": {
+      "postfix": "analysis",
+      "collection": "vulnerabilities-analysis",
+      "dataRoot": "data"
     }
   },
   "properties": {
@@ -64,6 +79,19 @@
       "item": true,
       "valueType": "string"
     },
+    "subnetIp": {
+      "label": "Subnet IP",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.subnetIp"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
     "assetType": {
       "label": "Asset Type",
       "source": {
@@ -362,11 +390,105 @@
       "list": false,
       "item": true,
       "valueType": "object"
+    },
+    "analysisBriefSummary": {
+      "label": "Brief Summary",
+      "source": { "contentType": "analysis", "path": "data.brief.summary" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisBriefAnalysis": {
+      "label": "Brief Analysis",
+      "source": { "contentType": "analysis", "path": "data.brief.analysis" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisBriefEvidence": {
+      "label": "Brief Evidence",
+      "source": { "contentType": "analysis", "path": "data.brief.evidence" },
+      "humanReadable": true,
+      "list": false,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisBriefGaps": {
+      "label": "Brief Gaps",
+      "source": { "contentType": "analysis", "path": "data.brief.gaps" },
+      "humanReadable": true,
+      "list": false,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisApplicability": {
+      "label": "Applicability",
+      "source": { "contentType": "analysis", "path": "data.applicability" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisExploitability": {
+      "label": "Exploitability",
+      "source": { "contentType": "analysis", "path": "data.exploitability" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisImpact": {
+      "label": "Impact",
+      "source": { "contentType": "analysis", "path": "data.impact" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisThreat": {
+      "label": "Threat",
+      "source": { "contentType": "analysis", "path": "data.threat" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisMitre": {
+      "label": "MITRE",
+      "source": { "contentType": "analysis", "path": "data.mitre" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "array"
+    },
+    "analysisClassType": {
+      "label": "Analysis Class",
+      "source": { "contentType": "analysis", "path": "data.class.type" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisExploitabilityLevel": {
+      "label": "Exploitability Level (analysis)",
+      "source": { "contentType": "analysis", "path": "data.exploitability.exploitability" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
     }
   },
+  "importanceIndicator": {
+    "path": "data.severity",
+    "valueKind": "severity",
+    "order": "desc",
+    "description": "Default vulnerability importance: critical > high > medium > low > none"
+  },
   "associatedProperties": [
     {
-      "name": "associatedData",
+      "name": "associatedVulnerabilitiesGroupsSnapshots",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -378,19 +500,31 @@
       "sourceCollection": "vulnerabilities-groups-snapshots"
     },
     {
-      "name": "associatedInferred",
+      "name": "associatedVulnerabilitiesGroupsEnrichment",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities-groups",
+      "linkedContentType": "snapshots",
+      "description": "Vulnerability group enrichment payloads (CVSS/EPSS/KEV/compositeScore) copied flat from vulnerabilities-groups-snapshots.enrichment when data.vulnerabilityName matches group data.name. Omitted when enrichment is missing or empty.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerability-groups.enrichment.by-name",
+      "sourceCollection": "vulnerabilities-groups-snapshots"
+    },
+    {
+      "name": "associatedVulnerabilitiesGroupsDiscovery",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
       "linkedObjectType": "vulnerabilities-groups",
-      "linkedContentType": "inferences",
-      "description": "Vulnerability group discovery payloads copied from vulnerabilities-groups-inferences.data via group name bridge.",
+      "linkedContentType": "discovery",
+      "description": "Vulnerability group discovery payloads copied from vulnerabilities-groups-discovery.data via group name bridge.",
       "managed": true,
-      "refreshRuleKey": "vulnerabilities.vulnerability-groups.inferences.by-name",
-      "sourceCollection": "vulnerabilities-groups-inferences"
+      "refreshRuleKey": "vulnerabilities.vulnerability-groups.discovery.by-name",
+      "sourceCollection": "vulnerabilities-groups-discovery"
     },
     {
-      "name": "associatedAnalysis",
+      "name": "associatedVulnerabilitiesGroupsAnalysis",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -402,18 +536,283 @@
       "sourceCollection": "vulnerabilities-groups-analysis"
     },
     {
-      "name": "associatedAssets",
+      "name": "associatedAssetsSnapshots",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
       "linkedObjectType": "assets",
       "linkedContentType": "snapshots",
-      "description": "Optional asset snapshot payloads copied from assets-snapshots.data when data.assetIp matches asset data.assetIps.",
+      "description": "Optional asset snapshot payloads copied from assets-snapshots.data when data.assetIp exactly matches asset data.assetIps, data.assetIp, or legacy data.ip_address. At most one item per vulnerability.",
       "managed": true,
       "refreshRuleKey": "vulnerabilities.assets.snapshots.by-assetIp",
       "sourceCollection": "assets-snapshots"
+    },
+    {
+      "name": "associatedTopology",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "subnets",
+      "linkedContentType": "snapshots",
+      "description": "Normalized subnet topology objects from associatedData roll-down and canonical subnet lookup by data.assetIp. May contain both associatedData and subnetLookup sources for the same CIDR.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.associated-topology.by-associated-data-and-subnet-lookup",
+      "sourceCollection": "subnets-snapshots"
+    },
+    {
+      "name": "associatedVulnerabilitiesGroupsSnapshots",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities-groups",
+      "linkedContentType": "snapshots",
+      "description": "Explicit vulnerability group snapshot payloads copied from vulnerabilities-groups-snapshots.data when data.vulnerabilityName matches group data.name.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerability-groups.snapshots.explicit.by-name",
+      "sourceCollection": "vulnerabilities-groups-snapshots"
+    },
+    {
+      "name": "associatedVulnerabilitiesGroupsDiscovery",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities-groups",
+      "linkedContentType": "discovery",
+      "description": "Explicit vulnerability group discovery payloads copied from vulnerabilities-groups-discovery via group name bridge.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerability-groups.discovery.explicit.by-name",
+      "sourceCollection": "vulnerabilities-groups-discovery"
+    },
+    {
+      "name": "associatedVulnerabilitiesGroupsAnalysis",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities-groups",
+      "linkedContentType": "analysis",
+      "description": "Explicit vulnerability group analysis payloads copied from vulnerabilities-groups-analysis via group name bridge.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerability-groups.analysis.explicit.by-name",
+      "sourceCollection": "vulnerabilities-groups-analysis"
+    },
+    {
+      "name": "associatedVulnerabilitiesDiscovery",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities",
+      "linkedContentType": "discovery",
+      "description": "Vulnerability discovery payloads copied from vulnerabilities-discovery.data after matching vulnerabilities-snapshots by data.assetIp and resolving content by snapshot recordId.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerabilities.discovery.by-assetIp",
+      "sourceCollection": "vulnerabilities-discovery"
+    },
+    {
+      "name": "associatedVulnerabilitiesDecisions",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities",
+      "linkedContentType": "decisions",
+      "description": "Vulnerability decision payloads copied from vulnerabilities-decisions.data after matching vulnerabilities-snapshots by data.assetIp and resolving content by snapshot recordId.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerabilities.decisions.by-assetIp",
+      "sourceCollection": "vulnerabilities-decisions"
     }
   ],
+  "processing": {
+    "entityRoutes": [
+      {
+        "routeKey": "groups-to-vulnerabilities",
+        "parentObjectType": "vulnerabilities-groups",
+        "childObjectType": "vulnerabilities",
+        "relationshipName": "vulnerabilityGroup",
+        "direction": "parentToChild",
+        "source": {
+          "contentType": "snapshots",
+          "path": "data.vulnerabilityName"
+        },
+        "target": {
+          "contentType": "snapshots",
+          "path": "data.name"
+        },
+        "prerequisites": [
+          {
+            "parentObjectType": "vulnerabilities-groups",
+            "parentContentPostfix": "analysis",
+            "lifecycleProcess": "entity-insights-processed",
+            "onMissing": "defer"
+          }
+        ]
+      },
+      {
+        "routeKey": "assets-to-vulnerabilities",
+        "parentObjectType": "assets",
+        "childObjectType": "vulnerabilities",
+        "relationshipName": "affectedAsset",
+        "direction": "parentToChild",
+        "source": {
+          "contentType": "snapshots",
+          "path": "data.assetIp"
+        },
+        "target": {
+          "contentType": "snapshots",
+          "path": "data.assetIps"
+        }
+      }
+    ],
+    "resolvers": [
+      {
+        "processorId": "vulnerabilities.topology-extractor",
+        "resolverType": "topology-extractor",
+        "kind": "function",
+        "config": {
+          "mode": "subnet-lookup",
+          "assetIpPath": "data.assetIp",
+          "sourcePaths": [
+            "associatedVulnerabilitiesGroupsSnapshots"
+          ],
+          "outputPath": "associatedTopology",
+          "canonicalCollection": {
+            "db": "neo-memorix-entities",
+            "collection": "subnets-snapshots"
+          }
+        }
+      }
+    ],
+    "associatedContent": {
+      "rollParentSnapshots": true,
+      "excludePostfixes": [
+        "raw"
+      ]
+    }
+  },
+  "narratives": {
+    "has-assets": {
+      "label": "Has assets",
+      "displayName": "Has assets",
+      "kind": "having-signal",
+      "visibility": "user",
+      "sourceRef": "affectedAsset",
+      "targetEntity": "assets"
+    },
+    "lack-analysis-decision": {
+      "label": "Analysis without decision",
+      "displayName": "Analysis without decision",
+      "description": "Linked vulnerabilities-analysis exists but data.decision is missing or empty.",
+      "kind": "association-common-property",
+      "visibility": "internal",
+      "sourceRef": "vulnerabilities-analysis",
+      "property": "decision"
+    },
+    "has-vulnerability-lack-analysis-decision": {
+      "label": "Has vulnerability lacking analysis decision",
+      "displayName": "Lacking analysis decision",
+      "description": "Alias of lack-analysis-decision for has-* consumers.",
+      "kind": "association-common-property",
+      "visibility": "internal",
+      "sourceRef": "vulnerabilities-analysis",
+      "property": "decision"
+    },
+    "is-vulnerability": {
+      "label": "Is vulnerability",
+      "displayName": "Vulnerability",
+      "description": "Security-impacting scanner result (severity low/medium/high/critical).",
+      "kind": "product-narrative",
+      "visibility": "user"
+    },
+    "is-finding": {
+      "label": "Is finding",
+      "displayName": "Informational finding",
+      "description": "Informational scanner result (severity none/unknown).",
+      "kind": "product-narrative",
+      "visibility": "user"
+    },
+    "has-analysis": {
+      "label": "Has analysis",
+      "displayName": "Has analysis",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-fix-immediately-decision": {
+      "label": "Fix immediately",
+      "displayName": "Fix Immediately",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-remediate-soon-decision": {
+      "label": "Remediate soon",
+      "displayName": "Remediate Soon",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-mitigate-decision": {
+      "label": "Mitigate",
+      "displayName": "Mitigate",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-accept-decision": {
+      "label": "Accept",
+      "displayName": "Accept Risk",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-triage-decision": {
+      "label": "Has triage decision",
+      "displayName": "Triaged",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-breach-vector": {
+      "label": "Breach vector",
+      "displayName": "Breach Vector",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-critical-severity": {
+      "label": "Critical severity",
+      "displayName": "Critical",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-high-severity": {
+      "label": "High severity",
+      "displayName": "High",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-medium-severity": {
+      "label": "Medium severity",
+      "displayName": "Medium",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-low-severity": {
+      "label": "Low severity",
+      "displayName": "Low",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-none-severity": {
+      "label": "None severity",
+      "displayName": "None",
+      "kind": "rollup",
+      "visibility": "internal"
+    },
+    "has-tenable-nessus-finding": {
+      "label": "Tenable Nessus finding",
+      "displayName": "Tenable Nessus",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "lack-analysis": {
+      "label": "Lack analysis",
+      "displayName": "Missing analysis",
+      "kind": "gap-signal",
+      "visibility": "internal"
+    }
+  },
   "relations": {
     "affectedAsset": {
       "targetEntity": "assets",
@@ -427,7 +826,7 @@
         "path": "data.assetIps"
       },
       "defaultMode": "array",
-      "defaultArrayProperty": "associatedAssets",
+      "defaultArrayProperty": "associatedAssetsSnapshots",
       "targetFields": [
         "ipAddress",
         "hostName",
@@ -448,7 +847,7 @@
         "path": "data.name"
       },
       "defaultMode": "array",
-      "defaultArrayProperty": "associatedData",
+      "defaultArrayProperty": "associatedVulnerabilitiesGroupsSnapshots",
       "targetFields": [
         "name",
         "severity",

package/catalox-seeds/inputs/item-descriptors/asset-detail-item.json

@@ -18,9 +18,68 @@
           "data.lastSeen"
         ]
       }
+    },
+    {
+      "contentType": "analysis",
+      "required": false,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
+      }
+    },
+    {
+      "contentType": "decisions",
+      "required": false,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
+      }
     }
   ],
   "sections": [
+    {
+      "id": "brief",
+      "title": "Brief",
+      "fields": [
+        "analysisBriefSummary",
+        "analysisBriefTakeaway",
+        "analysisBriefConfidence"
+      ]
+    },
+    {
+      "id": "context",
+      "title": "Context",
+      "fields": ["analysisContext"]
+    },
+    {
+      "id": "reachability",
+      "title": "Reachability",
+      "fields": ["analysisReachability"]
+    },
+    {
+      "id": "paths",
+      "title": "Paths",
+      "fields": ["analysisPaths", "attackPathExistence", "pathsCount"]
+    },
+    {
+      "id": "exploitability",
+      "title": "Exploitability",
+      "fields": ["decisionExploitability"]
+    },
+    {
+      "id": "decision",
+      "title": "Decision",
+      "fields": [
+        "decisionOverviewSummary",
+        "decisionOverviewDetailedAnalysis",
+        "decisionLabel",
+        "decisionStatus",
+        "decisionRiskScore",
+        "decisionUrgencyScore"
+      ]
+    },
     {
       "id": "summary",
       "title": "Summary",
@@ -33,6 +92,7 @@
         "agentType",
         "xdrOperationalStatus",
         "xdrAgentStatus",
+        "observedUsers",
         "lastSeen",
         "pathsCount"
       ]
@@ -41,11 +101,11 @@
       "id": "vulnerabilitySummary",
       "title": "Vulnerability Summary",
       "fields": [
-        "hasVulnerabilities",
         "criticalVulnerabilities",
         "highVulnerabilities",
         "mediumVulnerabilities",
-        "lowVulnerabilities"
+        "lowVulnerabilities",
+        "findingsCount"
       ]
     },
     {
@@ -56,13 +116,6 @@
         "potentialImpactConfidence",
         "potentialImpactStory"
       ]
-    },
-    {
-      "id": "xdr",
-      "title": "XDR",
-      "fields": [
-        "rawXdr"
-      ]
     }
   ],
   "includeRelations": [
@@ -70,12 +123,7 @@
       "relation": "assetSubnet",
       "mode": "record",
       "limit": 1,
-      "fields": [
-        "cidr",
-        "subnetIp",
-        "zone",
-        "vr"
-      ]
+      "fields": ["cidr", "subnetIp", "zone", "vr"]
     },
     {
       "relation": "assetVulnerabilities",