@x12i/memorix-retrieval 1.30.0 → 1.32.0

package/catalox-seeds/inputs/item-descriptors/subnet-detail-item.json

@@ -12,10 +12,16 @@
       "multiMatch": {
         "strategy": "last",
         "effectiveDatePath": "capturedAt",
-        "fallbackEffectiveDatePaths": [
-          "modifiedAt",
-          "createdAt"
-        ]
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
+      }
+    },
+    {
+      "contentType": "analysis",
+      "required": false,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
       }
     },
     {
@@ -24,14 +30,46 @@
       "multiMatch": {
         "strategy": "last",
         "effectiveDatePath": "capturedAt",
-        "fallbackEffectiveDatePaths": [
-          "modifiedAt",
-          "createdAt"
-        ]
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
       }
     }
   ],
   "sections": [
+    {
+      "id": "overview",
+      "title": "Overview",
+      "fields": ["analysisOverview", "analysisOverviewSummary"]
+    },
+    {
+      "id": "role",
+      "title": "Role",
+      "fields": ["analysisRole"]
+    },
+    {
+      "id": "exposure",
+      "title": "Exposure",
+      "fields": ["analysisExposure", "outsideExposureClass"]
+    },
+    {
+      "id": "trust",
+      "title": "Trust",
+      "fields": ["analysisTrust"]
+    },
+    {
+      "id": "attack-path",
+      "title": "Attack Path",
+      "fields": ["analysisAttackPath"]
+    },
+    {
+      "id": "movement",
+      "title": "Movement",
+      "fields": ["analysisMovement"]
+    },
+    {
+      "id": "context",
+      "title": "Context",
+      "fields": ["analysisContext"]
+    },
     {
       "id": "summary",
       "title": "Summary",
@@ -41,6 +79,11 @@
         "zone",
         "zoneClass",
         "vr",
+        "assetsCount",
+        "findingsCount",
+        "vulnerabilitiesCount",
+        "criticalVulnerabilities",
+        "highVulnerabilities",
         "recordId"
       ]
     },
@@ -56,15 +99,6 @@
         "reachableFromZones",
         "zoneMappingConfidence"
       ]
-    },
-    {
-      "id": "legacy",
-      "title": "Legacy (quarantined)",
-      "fields": [
-        "quarantineLegacy",
-        "legacySubnetIp",
-        "quarantineReason"
-      ]
     }
   ],
   "includeRelations": [],

package/catalox-seeds/inputs/item-descriptors/vulnerabilities-group-detail-item.json

@@ -0,0 +1,97 @@
+{
+  "id": "vulnerabilities-group-detail-item",
+  "entity": "vulnerabilities-groups",
+  "title": "Vulnerability Group Detail",
+  "identity": {
+    "idField": "recordId"
+  },
+  "contentTypes": [
+    {
+      "contentType": "snapshots",
+      "required": true,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": [
+          "modifiedAt",
+          "createdAt",
+          "data.enrichment.enrichedAt"
+        ]
+      }
+    },
+    {
+      "contentType": "analysis",
+      "required": false,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
+      }
+    }
+  ],
+  "sections": [
+    {
+      "id": "brief",
+      "title": "Brief",
+      "fields": [
+        "analysisBriefSummary",
+        "analysisBriefAnalysis",
+        "analysisBriefEvidence",
+        "analysisBriefGaps"
+      ]
+    },
+    {
+      "id": "applicability",
+      "title": "Applicability",
+      "fields": ["analysisApplicability"]
+    },
+    {
+      "id": "exploitability",
+      "title": "Exploitability",
+      "fields": ["analysisExploitability"]
+    },
+    {
+      "id": "impact",
+      "title": "Impact",
+      "fields": ["analysisImpact"]
+    },
+    {
+      "id": "threat",
+      "title": "Threat",
+      "fields": ["analysisThreat", "knownExploited"]
+    },
+    {
+      "id": "mitre",
+      "title": "Mitre",
+      "fields": ["analysisMitre"]
+    },
+    {
+      "id": "summary",
+      "title": "Summary",
+      "fields": [
+        "name",
+        "vulnerabilityType",
+        "cveId",
+        "pluginId",
+        "severity",
+        "affectedEntitiesCount",
+        "findingsCount",
+        "vulnerabilitiesCount",
+        "riskLevel",
+        "priorityScore"
+      ]
+    }
+  ],
+  "includeRelations": [
+    {
+      "relation": "groupVulnerabilities",
+      "mode": "array",
+      "arrayProperty": "vulnerabilities",
+      "limit": 200,
+      "fields": ["assetIp", "severity", "cveId", "pluginName"]
+    }
+  ],
+  "content": {
+    "allowed": false
+  }
+}

package/catalox-seeds/inputs/item-descriptors/vulnerability-detail-item.json

@@ -18,60 +18,65 @@
           "data.enrichment.enrichedAt"
         ]
       }
+    },
+    {
+      "contentType": "analysis",
+      "required": false,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
+      }
     }
   ],
   "sections": [
     {
-      "id": "summary",
-      "title": "Summary",
+      "id": "brief",
+      "title": "Brief",
       "fields": [
-        "vulnerabilityId",
-        "pluginName",
-        "pluginFamily",
-        "severity",
-        "cveId"
+        "analysisBriefSummary",
+        "analysisBriefAnalysis",
+        "analysisBriefEvidence",
+        "analysisBriefGaps"
       ]
     },
     {
-      "id": "asset",
-      "title": "Affected Asset",
-      "fields": [
-        "assetIp",
-        "assetType",
-        "assetZone",
-        "assetHostname",
-        "assetMatched"
-      ]
+      "id": "applicability",
+      "title": "Applicability",
+      "fields": ["analysisApplicability"]
     },
     {
-      "id": "risk",
-      "title": "Risk",
-      "fields": [
-        "riskLevel",
-        "priorityScore",
-        "compositeScore",
-        "exploitabilityScore",
-        "exploitabilityLevel"
-      ]
+      "id": "exploitability",
+      "title": "Exploitability",
+      "fields": ["analysisExploitability", "analysisExploitabilityLevel"]
     },
     {
-      "id": "threatIntelligence",
-      "title": "Threat Intelligence",
-      "fields": [
-        "epss",
-        "epssPercentile",
-        "knownExploited",
-        "cvssBaseScore",
-        "cvssVector"
-      ]
+      "id": "impact",
+      "title": "Impact",
+      "fields": ["analysisImpact"]
+    },
+    {
+      "id": "threat",
+      "title": "Threat",
+      "fields": ["analysisThreat", "knownExploited", "epss"]
+    },
+    {
+      "id": "mitre",
+      "title": "Mitre",
+      "fields": ["analysisMitre", "mitreTechniques", "mitreAnalysis"]
     },
     {
-      "id": "networkAndMitre",
-      "title": "Network & MITRE",
+      "id": "summary",
+      "title": "Summary",
       "fields": [
-        "networkExposure",
-        "mitreTechniques",
-        "mitreAnalysis"
+        "vulnerabilityId",
+        "pluginName",
+        "pluginFamily",
+        "severity",
+        "cveId",
+        "assetIp",
+        "riskLevel",
+        "priorityScore"
       ]
     }
   ],

package/catalox-seeds/inputs/item-descriptors/vulnerability-observation-detail-item.json

@@ -0,0 +1,42 @@
+{
+  "id": "vulnerability-observation-detail-item",
+  "entity": "vulnerabilities",
+  "title": "Observation Detail",
+  "identity": {
+    "idField": "recordId"
+  },
+  "contentTypes": [
+    {
+      "contentType": "snapshots",
+      "required": true,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "data.lastSeen",
+        "fallbackEffectiveDatePaths": [
+          "capturedAt",
+          "snapshot.capturedAt",
+          "data.enrichment.enrichedAt"
+        ]
+      }
+    }
+  ],
+  "sections": [
+    {
+      "id": "brief",
+      "title": "Brief",
+      "fields": [
+        "assetIp",
+        "pluginName",
+        "severity",
+        "cveId",
+        "riskLevel",
+        "priorityScore",
+        "knownExploited"
+      ]
+    }
+  ],
+  "includeRelations": [],
+  "content": {
+    "allowed": false
+  }
+}

package/catalox-seeds/inputs/list-descriptors/assets-exploitability-decisions-list.json

@@ -0,0 +1,33 @@
+{
+  "id": "assets-exploitability-decisions-list",
+  "entity": "assets",
+  "title": "Assets Exploitability",
+  "leadingContentType": "decisions",
+  "pagination": {
+    "enabled": true,
+    "defaultLimit": 50,
+    "maxLimit": 200
+  },
+  "filters": [],
+  "fields": [
+    "decisionOverviewSummary",
+    "decisionOverviewDetailedAnalysis",
+    "decisionLabel",
+    "decisionStatus",
+    "decisionRiskScore",
+    "decisionUrgencyScore"
+  ],
+  "extensions": [],
+  "includeRelations": [],
+  "allowedSorts": [
+    "decisionRiskScore",
+    "decisionUrgencyScore",
+    "decisionStatus",
+    "decisionLabel"
+  ],
+  "defaultSort": {
+    "property": "decisionRiskScore",
+    "direction": "desc"
+  },
+  "allowSortDrivenLeadingOverride": false
+}

package/catalox-seeds/inputs/list-descriptors/assets-main-list.json

@@ -18,11 +18,13 @@
     "agentType",
     "xdrOperationalStatus",
     "xdrAgentStatus",
-    "hasVulnerabilities",
     "criticalVulnerabilities",
     "highVulnerabilities",
+    "findingsCount",
     "potentialImpactLevel",
-    "pathsCount"
+    "pathsCount",
+    "observedUsers",
+    "lastSeen"
   ],
   "extensions": [],
   "includeRelations": [],
@@ -35,9 +37,9 @@
     "agentType",
     "xdrOperationalStatus",
     "xdrAgentStatus",
-    "hasVulnerabilities",
     "criticalVulnerabilities",
     "highVulnerabilities",
+    "findingsCount",
     "potentialImpactLevel",
     "pathsCount",
     "lastSeen"
@@ -46,5 +48,55 @@
     "property": "ipAddress",
     "direction": "asc"
   },
-  "allowSortDrivenLeadingOverride": false
+  "allowSortDrivenLeadingOverride": false,
+  "columnDrillDowns": [
+    {
+      "field": "criticalVulnerabilities",
+      "label": "Critical Vulnerabilities",
+      "listQuery": {
+        "entityName": "vulnerabilities",
+        "listDescriptorId": "vulnerabilities-main-list",
+        "narrativeIds": ["is-vulnerability", "has-critical-severity"],
+        "filters": [
+          {
+            "property": "assetIp",
+            "operator": "eq",
+            "valueFromRow": "ipAddress"
+          }
+        ]
+      }
+    },
+    {
+      "field": "highVulnerabilities",
+      "label": "High Vulnerabilities",
+      "listQuery": {
+        "entityName": "vulnerabilities",
+        "listDescriptorId": "vulnerabilities-main-list",
+        "narrativeIds": ["is-vulnerability", "has-high-severity"],
+        "filters": [
+          {
+            "property": "assetIp",
+            "operator": "eq",
+            "valueFromRow": "ipAddress"
+          }
+        ]
+      }
+    },
+    {
+      "field": "findingsCount",
+      "label": "Findings",
+      "listQuery": {
+        "entityName": "vulnerabilities",
+        "listDescriptorId": "vulnerabilities-observations-list",
+        "narrativeIds": ["is-finding"],
+        "filters": [
+          {
+            "property": "assetIp",
+            "operator": "eq",
+            "valueFromRow": "ipAddress"
+          }
+        ]
+      }
+    }
+  ]
 }

package/catalox-seeds/inputs/list-descriptors/assets-potential-impact-decisions-list.json

@@ -0,0 +1,31 @@
+{
+  "id": "assets-potential-impact-decisions-list",
+  "entity": "assets",
+  "title": "Asset's Potential Impact",
+  "leadingContentType": "decisions",
+  "pagination": {
+    "enabled": true,
+    "defaultLimit": 50,
+    "maxLimit": 200
+  },
+  "filters": [],
+  "fields": [
+    "decisionOverviewSummary",
+    "decisionOverviewDetailedAnalysis",
+    "decisionLabel",
+    "decisionStatus",
+    "decisionRiskScore"
+  ],
+  "extensions": [],
+  "includeRelations": [],
+  "allowedSorts": [
+    "decisionRiskScore",
+    "decisionStatus",
+    "decisionLabel"
+  ],
+  "defaultSort": {
+    "property": "decisionRiskScore",
+    "direction": "desc"
+  },
+  "allowSortDrivenLeadingOverride": false
+}

package/catalox-seeds/inputs/list-descriptors/subnets-main-list.json

@@ -1,22 +1,126 @@
 {
   "id": "subnets-main-list",
   "entity": "subnets",
-  "title": "Subnets",
+  "title": "Networks",
   "leadingContentType": "snapshots",
   "fields": [
-    "cidr",
     "subnetIp",
+    "cidr",
     "zone",
+    "zoneClass",
     "vr",
+    "networkAddress",
+    "assetsCount",
+    "findingsCount",
+    "vulnerabilitiesCount",
+    "criticalVulnerabilities",
+    "highVulnerabilities",
+    "outsideExposureClass",
+    "internalReachabilityClass",
     "recordId"
   ],
   "defaultSort": {
     "property": "cidr",
     "direction": "asc"
   },
+  "allowedSorts": [
+    "subnetIp",
+    "cidr",
+    "zone",
+    "zoneClass",
+    "vr",
+    "assetsCount",
+    "findingsCount",
+    "vulnerabilitiesCount",
+    "criticalVulnerabilities",
+    "highVulnerabilities",
+    "outsideExposureClass",
+    "internalReachabilityClass"
+  ],
   "pagination": {
     "enabled": true,
     "defaultLimit": 50,
     "maxLimit": 200
-  }
+  },
+  "columnDrillDowns": [
+    {
+      "field": "assetsCount",
+      "label": "Assets #",
+      "listQuery": {
+        "entityName": "assets",
+        "listDescriptorId": "assets-main-list",
+        "filters": [
+          {
+            "property": "subnetCidrs",
+            "operator": "eq",
+            "valueFromRow": "cidr"
+          }
+        ]
+      }
+    },
+    {
+      "field": "findingsCount",
+      "label": "Findings #",
+      "listQuery": {
+        "entityName": "vulnerabilities",
+        "listDescriptorId": "vulnerabilities-observations-list",
+        "narrativeIds": ["is-finding"],
+        "filters": [
+          {
+            "property": "subnetIp",
+            "operator": "eq",
+            "valueFromRow": "networkAddress"
+          }
+        ]
+      }
+    },
+    {
+      "field": "vulnerabilitiesCount",
+      "label": "Vulnerabilities #",
+      "listQuery": {
+        "entityName": "vulnerabilities",
+        "listDescriptorId": "vulnerabilities-main-list",
+        "narrativeIds": ["is-vulnerability"],
+        "filters": [
+          {
+            "property": "subnetIp",
+            "operator": "eq",
+            "valueFromRow": "networkAddress"
+          }
+        ]
+      }
+    },
+    {
+      "field": "criticalVulnerabilities",
+      "label": "Critical Vulnerabilities",
+      "listQuery": {
+        "entityName": "vulnerabilities",
+        "listDescriptorId": "vulnerabilities-main-list",
+        "narrativeIds": ["is-vulnerability", "has-critical-severity"],
+        "filters": [
+          {
+            "property": "subnetIp",
+            "operator": "eq",
+            "valueFromRow": "networkAddress"
+          }
+        ]
+      }
+    },
+    {
+      "field": "highVulnerabilities",
+      "label": "High Vulnerabilities",
+      "listQuery": {
+        "entityName": "vulnerabilities",
+        "listDescriptorId": "vulnerabilities-main-list",
+        "narrativeIds": ["is-vulnerability", "has-high-severity"],
+        "filters": [
+          {
+            "property": "subnetIp",
+            "operator": "eq",
+            "valueFromRow": "networkAddress"
+          }
+        ]
+      }
+    }
+  ]
 }

package/catalox-seeds/inputs/list-descriptors/vulnerabilities-exploitability-analysis-list.json

@@ -0,0 +1,29 @@
+{
+  "id": "vulnerabilities-exploitability-analysis-list",
+  "entity": "vulnerabilities",
+  "title": "Vulnerabilities Exploitability",
+  "leadingContentType": "analysis",
+  "pagination": {
+    "enabled": true,
+    "defaultLimit": 50,
+    "maxLimit": 200
+  },
+  "filters": [],
+  "fields": [
+    "analysisBriefSummary",
+    "analysisBriefAnalysis",
+    "analysisExploitabilityLevel",
+    "analysisClassType"
+  ],
+  "extensions": [],
+  "includeRelations": [],
+  "allowedSorts": [
+    "analysisExploitabilityLevel",
+    "analysisClassType"
+  ],
+  "defaultSort": {
+    "property": "analysisExploitabilityLevel",
+    "direction": "asc"
+  },
+  "allowSortDrivenLeadingOverride": false
+}