@x12i/memorix-retrieval 1.30.0 → 1.32.0

package/catalox-seeds/memorix-retrieval-descriptors.manifest.json

@@ -288,6 +288,18 @@
             "collection": "assets-scoped",
             "dataRoot": "data",
             "isCanonical": false
+          },
+          "analysis": {
+            "postfix": "analysis",
+            "collection": "assets-analysis",
+            "dataRoot": "data",
+            "isCanonical": false
+          },
+          "decisions": {
+            "postfix": "decision",
+            "collection": "assets-decision",
+            "dataRoot": "data",
+            "isCanonical": false
           }
         },
         "properties": {
@@ -295,7 +307,7 @@
             "label": "IP Address",
             "source": {
               "contentType": "snapshots",
-              "path": "data.ip_address"
+              "path": "data.assetIp"
             },
             "humanReadable": true,
             "sortable": true,
@@ -304,31 +316,31 @@
             "item": true,
             "valueType": "string"
           },
-          "subnetIp": {
-            "label": "Subnet IP",
+          "subnetCidrs": {
+            "label": "Subnet CIDRs",
             "source": {
               "contentType": "snapshots",
-              "path": "data.subnetIp"
+              "path": "data.subnetCidrs"
             },
             "humanReadable": true,
-            "sortable": true,
+            "sortable": false,
             "filterable": true,
-            "list": true,
+            "list": false,
             "item": true,
-            "valueType": "string"
+            "valueType": "array"
           },
-          "subnetCidr": {
-            "label": "Subnet CIDR",
+          "subnets": {
+            "label": "Resolved Subnets",
             "source": {
               "contentType": "snapshots",
-              "path": "data.subnetCidr"
+              "path": "data.subnets"
             },
-            "humanReadable": true,
-            "sortable": true,
-            "filterable": true,
+            "humanReadable": false,
+            "sortable": false,
+            "filterable": false,
             "list": false,
             "item": true,
-            "valueType": "string"
+            "valueType": "array"
           },
           "source": {
             "label": "Source",
@@ -408,19 +420,6 @@
             "item": true,
             "valueType": "datetime"
           },
-          "hasVulnerabilities": {
-            "label": "Has Vulnerabilities",
-            "source": {
-              "contentType": "snapshots",
-              "path": "data.hasVulnerabilities"
-            },
-            "humanReadable": true,
-            "sortable": true,
-            "filterable": true,
-            "list": true,
-            "item": true,
-            "valueType": "boolean"
-          },
           "criticalVulnerabilities": {
             "label": "Critical Vulnerabilities",
             "source": {
@@ -473,6 +472,20 @@
             "item": true,
             "valueType": "number"
           },
+          "findingsCount": {
+            "label": "Findings",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.findings.total"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number",
+            "format": "count"
+          },
           "potentialImpactLevel": {
             "label": "Potential Impact",
             "source": {
@@ -537,34 +550,468 @@
             "list": false,
             "item": true,
             "valueType": "object"
+          },
+          "observedUsers": {
+            "label": "Users",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.observedUsers"
+            },
+            "humanReadable": true,
+            "sortable": false,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "array"
+          },
+          "analysisBriefSummary": {
+            "label": "Brief Summary",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.summary"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefTakeaway": {
+            "label": "Brief Takeaway",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.takeaway"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefConfidence": {
+            "label": "Brief Confidence",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.confidence"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisContext": {
+            "label": "Context",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.context"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisReachability": {
+            "label": "Reachability",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.reachability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisPaths": {
+            "label": "Paths",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.paths"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "attackPathExistence": {
+            "label": "Attack Path Existence",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.paths.attackPathExistence"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "decisionOverviewSummary": {
+            "label": "Decision Summary",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.overview.summary"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "decisionOverviewDetailedAnalysis": {
+            "label": "Decision Detailed Analysis",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.overview.detailedAnalysis"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "decisionExploitability": {
+            "label": "Exploitability Analysis",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.exploitability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "decisionLabel": {
+            "label": "Decision",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.decision.decision"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "decisionStatus": {
+            "label": "Decision Status",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.decision.status"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "decisionRiskScore": {
+            "label": "Decision Score",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.decision.riskScore"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "decisionUrgencyScore": {
+            "label": "Urgency Score",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.decision.urgencyScore"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
           }
         },
         "associatedProperties": [
           {
-            "name": "associatedData",
+            "name": "associatedSubnetsSnapshots",
             "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
             "linkedObjectType": "subnets",
             "linkedContentType": "snapshots",
-            "description": "Subnet snapshot payloads copied from subnets-snapshots.data when asset data.subnetCidrs matches subnet data.cidr.",
+            "description": "Subnet snapshot payloads copied from subnets-snapshots.data when asset data.subnetCidrs matches subnet data.cidr. Each item includes linked recordId.",
             "managed": true,
             "refreshRuleKey": "assets.subnets.snapshots.by-cidr",
             "sourceCollection": "subnets-snapshots"
           },
           {
-            "name": "associatedInferred",
+            "name": "associatedSubnetsDiscovery",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "subnets",
+            "linkedContentType": "discovery",
+            "description": "Subnet discovery payloads copied from subnets-discovery.data when asset data.subnetCidrs matches subnet data.cidr.",
+            "managed": true,
+            "refreshRuleKey": "assets.subnets.discovery.by-cidr",
+            "sourceCollection": "subnets-discovery"
+          },
+          {
+            "name": "associatedAssetsSnapshots",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "assets",
+            "linkedContentType": "snapshots",
+            "description": "Root-level self-association: other asset snapshot data payloads sharing a data.subnetCidr value. Each item includes linked recordId. Capped at 99 items.",
+            "managed": true,
+            "refreshRuleKey": "assets.assets.snapshots.by-cidr",
+            "sourceCollection": "assets-snapshots"
+          },
+          {
+            "name": "associatedTopology",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "subnets",
+            "linkedContentType": "snapshots",
+            "description": "Normalized subnet topology objects derived from associatedData and canonical subnet lookup. Each item includes kind, source, cidr, zone, vr, and exposure/reachability fields. subnetId is omitted.",
+            "managed": true,
+            "refreshRuleKey": "assets.associated-topology.by-associated-data",
+            "sourceCollection": "subnets-snapshots"
+          },
+          {
+            "name": "associatedSubnetsSnapshots",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "subnets",
+            "linkedContentType": "snapshots",
+            "description": "Explicit subnet snapshot payloads copied from subnets-snapshots.data when asset data.subnetCidrs matches subnet data.cidr.",
+            "managed": true,
+            "refreshRuleKey": "assets.subnets.snapshots.explicit.by-cidr",
+            "sourceCollection": "subnets-snapshots"
+          },
+          {
+            "name": "associatedSubnetsDiscovery",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "subnets",
+            "linkedContentType": "discovery",
+            "description": "Explicit subnet discovery payloads copied from subnets-discovery when asset data.subnetCidrs matches subnet CIDR.",
+            "managed": true,
+            "refreshRuleKey": "assets.subnets.discovery.explicit.by-cidr",
+            "sourceCollection": "subnets-discovery"
+          },
+          {
+            "name": "associatedSubnetsAnalysis",
             "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
             "linkedObjectType": "subnets",
-            "linkedContentType": "inferences",
-            "description": "Subnet discovery payloads copied from subnets-inferences.data when asset data.subnetCidrs matches subnet data.cidr.",
+            "linkedContentType": "analysis",
+            "description": "Explicit subnet analysis payloads copied from subnets-analysis when asset data.subnetCidrs matches subnet CIDR.",
+            "managed": true,
+            "refreshRuleKey": "assets.subnets.analysis.explicit.by-cidr",
+            "sourceCollection": "subnets-analysis"
+          },
+          {
+            "name": "associatedTopologyZonesAnalysis",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "topology-zones",
+            "linkedContentType": "analysis",
+            "description": "Zone cyber-analysis payloads joined by host data.zones or associatedTopology.zone to topology-zones-analysis.data.name.",
+            "managed": true,
+            "refreshRuleKey": "assets.topology-zones.analysis.by-zone-name",
+            "sourceCollection": "topology-zones-analysis"
+          },
+          {
+            "name": "associatedVulnerabilitiesAnalysis",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities",
+            "linkedContentType": "analysis",
+            "description": "Vulnerability analysis payloads copied from vulnerabilities-analysis.data after matching vulnerabilities-snapshots by asset IP and resolving content by snapshot recordId.",
+            "managed": true,
+            "refreshRuleKey": "assets.vulnerabilities.analysis.by-assetIp",
+            "sourceCollection": "vulnerabilities-analysis"
+          },
+          {
+            "name": "associatedTopVulnerabilitiesAnalysis",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities",
+            "linkedContentType": "analysis",
+            "description": "Top vulnerability analysis payloads (default 5), ranked by vulnerabilities-snapshots.data.severity after IP match and content resolve by snapshot recordId. Omitted when empty.",
             "managed": true,
-            "refreshRuleKey": "assets.subnets.inferences.by-cidr",
-            "sourceCollection": "subnets-inferences"
+            "top": true,
+            "maxItems": 5,
+            "refreshRuleKey": "assets.vulnerabilities.analysis.top.by-assetIp",
+            "sourceCollection": "vulnerabilities-analysis"
           }
         ],
+        "processing": {
+          "entityRoutes": [
+            {
+              "routeKey": "subnets-to-assets",
+              "parentObjectType": "subnets",
+              "childObjectType": "assets",
+              "relationshipName": "assetSubnet",
+              "direction": "parentToChild",
+              "source": {
+                "contentType": "snapshots",
+                "path": "data.subnetCidrs"
+              },
+              "target": {
+                "contentType": "snapshots",
+                "path": "data.cidr"
+              }
+            }
+          ],
+          "resolvers": [
+            {
+              "processorId": "assets.subnet-cidr",
+              "resolverType": "subnet-cidr",
+              "kind": "function",
+              "config": {
+                "mode": "resolve",
+                "assetIpPaths": [
+                  "data.assetIps",
+                  "data.assetIp"
+                ],
+                "canonicalCollection": {
+                  "db": "neo-memorix-entities",
+                  "collection": "subnets-snapshots"
+                }
+              }
+            },
+            {
+              "processorId": "assets.topology-extractor",
+              "resolverType": "topology-extractor",
+              "kind": "function",
+              "config": {
+                "mode": "from-associated-data",
+                "sourcePaths": [
+                  "associatedSubnetsSnapshots"
+                ],
+                "outputPath": "associatedTopology"
+              }
+            }
+          ],
+          "associatedContent": {
+            "rollParentSnapshots": true,
+            "excludePostfixes": [
+              "raw"
+            ]
+          }
+        },
+        "narratives": {
+          "has-vulnerabilities": {
+            "label": "Has vulnerabilities",
+            "displayName": "Has vulnerabilities",
+            "kind": "having-signal",
+            "visibility": "user",
+            "sourceRef": "assetVulnerabilities",
+            "targetEntity": "vulnerabilities"
+          },
+          "has-medium-vulnerabilities": {
+            "label": "Has medium vulnerabilities",
+            "displayName": "Medium vulnerabilities",
+            "kind": "association-common-property",
+            "visibility": "user",
+            "sourceRef": "assetVulnerabilities",
+            "targetEntity": "vulnerabilities",
+            "property": "severity",
+            "value": "medium"
+          },
+          "is-triaged": {
+            "label": "Is triaged",
+            "displayName": "Triaged",
+            "kind": "product-narrative",
+            "visibility": "user"
+          },
+          "has-triage-decision": {
+            "label": "Has triage decision",
+            "displayName": "Has triage decision",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-no-vulnerabilities": {
+            "label": "No vulnerabilities",
+            "displayName": "No vulnerabilities",
+            "kind": "product-narrative",
+            "visibility": "user"
+          },
+          "has-accept-decision": {
+            "label": "Accept",
+            "displayName": "Accept Risk",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-mitigate-decision": {
+            "label": "Mitigate",
+            "displayName": "Mitigate",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-high-or-critical-exploitability": {
+            "label": "High or critical exploitability",
+            "displayName": "High exploitability",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-lateral-movement-risk": {
+            "label": "Lateral movement risk",
+            "displayName": "Lateral movement risk",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-critical-predicted-impact": {
+            "label": "Critical predicted impact",
+            "displayName": "Critical impact",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-high-predicted-impact": {
+            "label": "High predicted impact",
+            "displayName": "High impact",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-medium-predicted-impact": {
+            "label": "Medium predicted impact",
+            "displayName": "Medium impact",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-low-predicted-impact": {
+            "label": "Low predicted impact",
+            "displayName": "Low impact",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-palo-alto-firewall-source": {
+            "label": "Palo Alto Firewall",
+            "displayName": "Palo Alto Firewall",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-palo-alto-xdr-source": {
+            "label": "Palo Alto XDR",
+            "displayName": "Palo Alto XDR",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-tenable-nessus-source": {
+            "label": "Tenable Nessus",
+            "displayName": "Tenable Nessus",
+            "kind": "rollup",
+            "visibility": "user"
+          }
+        },
         "relations": {
           "assetSubnet": {
             "type": "manyToOne",
@@ -577,10 +1024,12 @@
               "path": "data.cidr"
             },
             "defaultMode": "array",
-            "defaultArrayProperty": "associatedData",
+            "defaultArrayProperty": "associatedSubnetsSnapshots",
             "targetFields": [
               "cidr",
-              "subnetIp",
+              "networkAddress",
+              "prefixLength",
+              "mask",
               "zone",
               "vr"
             ],
@@ -654,14 +1103,9 @@
             "collection": "subnets-snapshots",
             "isCanonical": true
           },
-          "core": {
-            "postfix": "core",
-            "collection": "subnets-core",
-            "isCanonical": false
-          },
-          "inferences": {
-            "postfix": "inferences",
-            "collection": "subnets-inferences",
+          "discovery": {
+            "postfix": "discovery",
+            "collection": "subnets-discovery",
             "isCanonical": false
           },
           "scoped": {
@@ -673,6 +1117,24 @@
             "postfix": "legacy",
             "collection": "subnets-legacy",
             "isCanonical": false
+          },
+          "analysis": {
+            "postfix": "analysis",
+            "collection": "subnets-analysis",
+            "dataRoot": "data",
+            "isCanonical": false
+          }
+        },
+        "rootProperties": {
+          "possiblePaths": {
+            "label": "Possible Paths",
+            "source": {
+              "contentType": "snapshots",
+              "path": "possiblePaths"
+            },
+            "valueShape": "object",
+            "description": "Subnet-specific topology path facts stored at the snapshot root.",
+            "managed": true
           }
         },
         "properties": {
@@ -702,11 +1164,11 @@
             "item": true,
             "valueType": "string"
           },
-          "subnetIp": {
-            "label": "Subnet network address",
+          "networkAddress": {
+            "label": "Network Address",
             "source": {
               "contentType": "snapshots",
-              "path": "data.subnetIp"
+              "path": "data.networkAddress"
             },
             "humanReadable": true,
             "sortable": true,
@@ -715,6 +1177,32 @@
             "item": true,
             "valueType": "string"
           },
+          "prefixLength": {
+            "label": "Prefix Length",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.prefixLength"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": false,
+            "item": true,
+            "valueType": "number"
+          },
+          "mask": {
+            "label": "Subnet Mask",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.mask"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
           "zone": {
             "label": "Zone",
             "source": {
@@ -871,6 +1359,100 @@
             "item": true,
             "valueType": "string"
           },
+          "assetsCount": {
+            "label": "Assets #",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.assets.total"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number",
+            "format": "count"
+          },
+          "findingsCount": {
+            "label": "Findings #",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.findings.total"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number",
+            "format": "count"
+          },
+          "vulnerabilitiesCount": {
+            "label": "Vulnerabilities #",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.total"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number",
+            "format": "count"
+          },
+          "criticalVulnerabilities": {
+            "label": "Critical Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.critical"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "highVulnerabilities": {
+            "label": "High Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.high"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "mediumVulnerabilities": {
+            "label": "Medium Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.medium"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "lowVulnerabilities": {
+            "label": "Low Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.low"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
           "quarantineReason": {
             "label": "Quarantine Reason",
             "source": {
@@ -883,6 +1465,195 @@
             "list": false,
             "item": true,
             "valueType": "string"
+          },
+          "analysisOverview": {
+            "label": "Overview",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.overview"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisOverviewSummary": {
+            "label": "Overview Summary",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.overview.summary"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisRole": {
+            "label": "Role",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.cyberRoleInterpretation"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisExposure": {
+            "label": "Exposure",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.externalAndLowerTrustReachability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisTrust": {
+            "label": "Trust",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.trustPositionInterpretation"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisAttackPath": {
+            "label": "Attack Path",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.possibleAttackPathAnalysis"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisMovement": {
+            "label": "Movement",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.outboundAndBlastPathInterpretation"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisContext": {
+            "label": "Context",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.aggregateContextInterpretation"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          }
+        },
+        "associatedProperties": [
+          {
+            "name": "associatedAssetsSnapshots",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "assets",
+            "linkedContentType": "snapshots",
+            "description": "Asset snapshot data payloads whose data.subnetCidrs contains this subnet data.cidr. Each item includes linked recordId. Capped at 99 items.",
+            "managed": true,
+            "refreshRuleKey": "subnets.assets.snapshots.by-cidr",
+            "sourceCollection": "assets-snapshots"
+          },
+          {
+            "name": "associatedTopologyZonesAnalysis",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "topology-zones",
+            "linkedContentType": "analysis",
+            "description": "Zone cyber-analysis joined from subnet data.zone to topology-zones-analysis.data.name.",
+            "managed": true,
+            "refreshRuleKey": "subnets.topology-zones.analysis.by-zone-name",
+            "sourceCollection": "topology-zones-analysis"
+          }
+        ],
+        "processing": {
+          "entityRoutes": [
+            {
+              "routeKey": "zones-to-subnets",
+              "parentObjectType": "topology-zones",
+              "childObjectType": "subnets",
+              "relationshipName": "subnetZone",
+              "direction": "parentToChild",
+              "source": {
+                "contentType": "snapshots",
+                "path": "data.zone"
+              },
+              "target": {
+                "contentType": "snapshots",
+                "path": "data.name"
+              }
+            }
+          ],
+          "resolvers": [
+            {
+              "processorId": "subnets.subnet-key",
+              "resolverType": "subnet-key",
+              "kind": "function",
+              "config": {
+                "mode": "from-cidr",
+                "sourcePath": "data.cidr"
+              }
+            },
+            {
+              "processorId": "subnets.zone-from-topology",
+              "resolverType": "zone-from-topology",
+              "kind": "function",
+              "config": {
+                "onlyWhenZoneIs": "UNKNOWN",
+                "topologyRaw": {
+                  "db": "memorix-knowledge",
+                  "collection": "topology-raw"
+                },
+                "zonesRegistry": {
+                  "db": "neo-memorix-entities",
+                  "collection": "topology-zones-snapshots"
+                }
+              }
+            }
+          ],
+          "insightStages": [
+            {
+              "processorId": "network.cidr-topology-path-resolver",
+              "kind": "function",
+              "inputKind": "cidr",
+              "outputKind": "cidr-path-facts",
+              "writeToInsights": false,
+              "sources": {
+                "topologyDb": "memorix-knowledge",
+                "topologyCollection": "topology-raw"
+              }
+            },
+            {
+              "processorId": "network.cidr-zone-path-insights",
+              "kind": "function",
+              "inputKind": "cidr-path-facts",
+              "outputKind": "insights",
+              "writeToInsights": true,
+              "sources": {
+                "zonesCollection": "topology-zones-snapshots"
+              }
+            }
+          ],
+          "associatedContent": {
+            "rollParentSnapshots": true,
+            "excludePostfixes": [
+              "raw"
+            ]
           }
         },
         "relations": {},
@@ -937,6 +1708,21 @@
               "snapshot.capturedAt",
               "data.enrichment.enrichedAt"
             ]
+          },
+          "discovery": {
+            "postfix": "discovery",
+            "collection": "vulnerabilities-discovery",
+            "dataRoot": "data"
+          },
+          "decisions": {
+            "postfix": "decisions",
+            "collection": "vulnerabilities-decisions",
+            "dataRoot": "data"
+          },
+          "analysis": {
+            "postfix": "analysis",
+            "collection": "vulnerabilities-analysis",
+            "dataRoot": "data"
           }
         },
         "properties": {
@@ -966,6 +1752,19 @@
             "item": true,
             "valueType": "string"
           },
+          "subnetIp": {
+            "label": "Subnet IP",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.subnetIp"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
           "assetType": {
             "label": "Asset Type",
             "source": {
@@ -1264,58 +2063,462 @@
             "list": false,
             "item": true,
             "valueType": "object"
-          }
-        },
-        "associatedProperties": [
-          {
-            "name": "associatedData",
-            "contentType": "snapshots",
-            "kind": "associated",
-            "valueShape": "array<object>",
-            "linkedObjectType": "vulnerabilities-groups",
-            "linkedContentType": "snapshots",
-            "description": "Vulnerability group snapshot payloads copied from vulnerabilities-groups-snapshots.data when data.vulnerabilityName matches group data.name.",
-            "managed": true,
-            "refreshRuleKey": "vulnerabilities.vulnerability-groups.snapshots.by-name",
-            "sourceCollection": "vulnerabilities-groups-snapshots"
           },
-          {
-            "name": "associatedInferred",
-            "contentType": "snapshots",
-            "kind": "associated",
-            "valueShape": "array<object>",
-            "linkedObjectType": "vulnerabilities-groups",
-            "linkedContentType": "inferences",
-            "description": "Vulnerability group discovery payloads copied from vulnerabilities-groups-inferences.data via group name bridge.",
-            "managed": true,
-            "refreshRuleKey": "vulnerabilities.vulnerability-groups.inferences.by-name",
-            "sourceCollection": "vulnerabilities-groups-inferences"
+          "analysisBriefSummary": {
+            "label": "Brief Summary",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.summary"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
           },
-          {
-            "name": "associatedAnalysis",
-            "contentType": "snapshots",
-            "kind": "associated",
-            "valueShape": "array<object>",
-            "linkedObjectType": "vulnerabilities-groups",
-            "linkedContentType": "analysis",
-            "description": "Vulnerability group analysis payloads copied from vulnerabilities-groups-analysis.data via group name bridge.",
-            "managed": true,
-            "refreshRuleKey": "vulnerabilities.vulnerability-groups.analysis.by-name",
-            "sourceCollection": "vulnerabilities-groups-analysis"
+          "analysisBriefAnalysis": {
+            "label": "Brief Analysis",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.analysis"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefEvidence": {
+            "label": "Brief Evidence",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.evidence"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefGaps": {
+            "label": "Brief Gaps",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.gaps"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisApplicability": {
+            "label": "Applicability",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.applicability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisExploitability": {
+            "label": "Exploitability",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.exploitability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisImpact": {
+            "label": "Impact",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.impact"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisThreat": {
+            "label": "Threat",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.threat"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisMitre": {
+            "label": "MITRE",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.mitre"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "array"
+          },
+          "analysisClassType": {
+            "label": "Analysis Class",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.class.type"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisExploitabilityLevel": {
+            "label": "Exploitability Level (analysis)",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.exploitability.exploitability"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          }
+        },
+        "importanceIndicator": {
+          "path": "data.severity",
+          "valueKind": "severity",
+          "order": "desc",
+          "description": "Default vulnerability importance: critical > high > medium > low > none"
+        },
+        "associatedProperties": [
+          {
+            "name": "associatedVulnerabilitiesGroupsSnapshots",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities-groups",
+            "linkedContentType": "snapshots",
+            "description": "Vulnerability group snapshot payloads copied from vulnerabilities-groups-snapshots.data when data.vulnerabilityName matches group data.name.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerability-groups.snapshots.by-name",
+            "sourceCollection": "vulnerabilities-groups-snapshots"
+          },
+          {
+            "name": "associatedVulnerabilitiesGroupsEnrichment",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities-groups",
+            "linkedContentType": "snapshots",
+            "description": "Vulnerability group enrichment payloads (CVSS/EPSS/KEV/compositeScore) copied flat from vulnerabilities-groups-snapshots.enrichment when data.vulnerabilityName matches group data.name. Omitted when enrichment is missing or empty.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerability-groups.enrichment.by-name",
+            "sourceCollection": "vulnerabilities-groups-snapshots"
+          },
+          {
+            "name": "associatedVulnerabilitiesGroupsDiscovery",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities-groups",
+            "linkedContentType": "discovery",
+            "description": "Vulnerability group discovery payloads copied from vulnerabilities-groups-discovery.data via group name bridge.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerability-groups.discovery.by-name",
+            "sourceCollection": "vulnerabilities-groups-discovery"
+          },
+          {
+            "name": "associatedVulnerabilitiesGroupsAnalysis",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities-groups",
+            "linkedContentType": "analysis",
+            "description": "Vulnerability group analysis payloads copied from vulnerabilities-groups-analysis.data via group name bridge.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerability-groups.analysis.by-name",
+            "sourceCollection": "vulnerabilities-groups-analysis"
           },
           {
-            "name": "associatedAssets",
+            "name": "associatedAssetsSnapshots",
             "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
             "linkedObjectType": "assets",
             "linkedContentType": "snapshots",
-            "description": "Optional asset snapshot payloads copied from assets-snapshots.data when data.assetIp matches asset data.assetIps.",
+            "description": "Optional asset snapshot payloads copied from assets-snapshots.data when data.assetIp exactly matches asset data.assetIps, data.assetIp, or legacy data.ip_address. At most one item per vulnerability.",
             "managed": true,
             "refreshRuleKey": "vulnerabilities.assets.snapshots.by-assetIp",
             "sourceCollection": "assets-snapshots"
+          },
+          {
+            "name": "associatedTopology",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "subnets",
+            "linkedContentType": "snapshots",
+            "description": "Normalized subnet topology objects from associatedData roll-down and canonical subnet lookup by data.assetIp. May contain both associatedData and subnetLookup sources for the same CIDR.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.associated-topology.by-associated-data-and-subnet-lookup",
+            "sourceCollection": "subnets-snapshots"
+          },
+          {
+            "name": "associatedVulnerabilitiesGroupsSnapshots",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities-groups",
+            "linkedContentType": "snapshots",
+            "description": "Explicit vulnerability group snapshot payloads copied from vulnerabilities-groups-snapshots.data when data.vulnerabilityName matches group data.name.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerability-groups.snapshots.explicit.by-name",
+            "sourceCollection": "vulnerabilities-groups-snapshots"
+          },
+          {
+            "name": "associatedVulnerabilitiesGroupsDiscovery",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities-groups",
+            "linkedContentType": "discovery",
+            "description": "Explicit vulnerability group discovery payloads copied from vulnerabilities-groups-discovery via group name bridge.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerability-groups.discovery.explicit.by-name",
+            "sourceCollection": "vulnerabilities-groups-discovery"
+          },
+          {
+            "name": "associatedVulnerabilitiesGroupsAnalysis",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities-groups",
+            "linkedContentType": "analysis",
+            "description": "Explicit vulnerability group analysis payloads copied from vulnerabilities-groups-analysis via group name bridge.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerability-groups.analysis.explicit.by-name",
+            "sourceCollection": "vulnerabilities-groups-analysis"
+          },
+          {
+            "name": "associatedVulnerabilitiesDiscovery",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities",
+            "linkedContentType": "discovery",
+            "description": "Vulnerability discovery payloads copied from vulnerabilities-discovery.data after matching vulnerabilities-snapshots by data.assetIp and resolving content by snapshot recordId.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerabilities.discovery.by-assetIp",
+            "sourceCollection": "vulnerabilities-discovery"
+          },
+          {
+            "name": "associatedVulnerabilitiesDecisions",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities",
+            "linkedContentType": "decisions",
+            "description": "Vulnerability decision payloads copied from vulnerabilities-decisions.data after matching vulnerabilities-snapshots by data.assetIp and resolving content by snapshot recordId.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerabilities.decisions.by-assetIp",
+            "sourceCollection": "vulnerabilities-decisions"
           }
         ],
+        "processing": {
+          "entityRoutes": [
+            {
+              "routeKey": "groups-to-vulnerabilities",
+              "parentObjectType": "vulnerabilities-groups",
+              "childObjectType": "vulnerabilities",
+              "relationshipName": "vulnerabilityGroup",
+              "direction": "parentToChild",
+              "source": {
+                "contentType": "snapshots",
+                "path": "data.vulnerabilityName"
+              },
+              "target": {
+                "contentType": "snapshots",
+                "path": "data.name"
+              },
+              "prerequisites": [
+                {
+                  "parentObjectType": "vulnerabilities-groups",
+                  "parentContentPostfix": "analysis",
+                  "lifecycleProcess": "entity-insights-processed",
+                  "onMissing": "defer"
+                }
+              ]
+            },
+            {
+              "routeKey": "assets-to-vulnerabilities",
+              "parentObjectType": "assets",
+              "childObjectType": "vulnerabilities",
+              "relationshipName": "affectedAsset",
+              "direction": "parentToChild",
+              "source": {
+                "contentType": "snapshots",
+                "path": "data.assetIp"
+              },
+              "target": {
+                "contentType": "snapshots",
+                "path": "data.assetIps"
+              }
+            }
+          ],
+          "resolvers": [
+            {
+              "processorId": "vulnerabilities.topology-extractor",
+              "resolverType": "topology-extractor",
+              "kind": "function",
+              "config": {
+                "mode": "subnet-lookup",
+                "assetIpPath": "data.assetIp",
+                "sourcePaths": [
+                  "associatedVulnerabilitiesGroupsSnapshots"
+                ],
+                "outputPath": "associatedTopology",
+                "canonicalCollection": {
+                  "db": "neo-memorix-entities",
+                  "collection": "subnets-snapshots"
+                }
+              }
+            }
+          ],
+          "associatedContent": {
+            "rollParentSnapshots": true,
+            "excludePostfixes": [
+              "raw"
+            ]
+          }
+        },
+        "narratives": {
+          "has-assets": {
+            "label": "Has assets",
+            "displayName": "Has assets",
+            "kind": "having-signal",
+            "visibility": "user",
+            "sourceRef": "affectedAsset",
+            "targetEntity": "assets"
+          },
+          "lack-analysis-decision": {
+            "label": "Analysis without decision",
+            "displayName": "Analysis without decision",
+            "description": "Linked vulnerabilities-analysis exists but data.decision is missing or empty.",
+            "kind": "association-common-property",
+            "visibility": "internal",
+            "sourceRef": "vulnerabilities-analysis",
+            "property": "decision"
+          },
+          "has-vulnerability-lack-analysis-decision": {
+            "label": "Has vulnerability lacking analysis decision",
+            "displayName": "Lacking analysis decision",
+            "description": "Alias of lack-analysis-decision for has-* consumers.",
+            "kind": "association-common-property",
+            "visibility": "internal",
+            "sourceRef": "vulnerabilities-analysis",
+            "property": "decision"
+          },
+          "is-vulnerability": {
+            "label": "Is vulnerability",
+            "displayName": "Vulnerability",
+            "description": "Security-impacting scanner result (severity low/medium/high/critical).",
+            "kind": "product-narrative",
+            "visibility": "user"
+          },
+          "is-finding": {
+            "label": "Is finding",
+            "displayName": "Informational finding",
+            "description": "Informational scanner result (severity none/unknown).",
+            "kind": "product-narrative",
+            "visibility": "user"
+          },
+          "has-analysis": {
+            "label": "Has analysis",
+            "displayName": "Has analysis",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-fix-immediately-decision": {
+            "label": "Fix immediately",
+            "displayName": "Fix Immediately",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-remediate-soon-decision": {
+            "label": "Remediate soon",
+            "displayName": "Remediate Soon",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-mitigate-decision": {
+            "label": "Mitigate",
+            "displayName": "Mitigate",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-accept-decision": {
+            "label": "Accept",
+            "displayName": "Accept Risk",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-triage-decision": {
+            "label": "Has triage decision",
+            "displayName": "Triaged",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-breach-vector": {
+            "label": "Breach vector",
+            "displayName": "Breach Vector",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-critical-severity": {
+            "label": "Critical severity",
+            "displayName": "Critical",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-high-severity": {
+            "label": "High severity",
+            "displayName": "High",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-medium-severity": {
+            "label": "Medium severity",
+            "displayName": "Medium",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-low-severity": {
+            "label": "Low severity",
+            "displayName": "Low",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-none-severity": {
+            "label": "None severity",
+            "displayName": "None",
+            "kind": "rollup",
+            "visibility": "internal"
+          },
+          "has-tenable-nessus-finding": {
+            "label": "Tenable Nessus finding",
+            "displayName": "Tenable Nessus",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "lack-analysis": {
+            "label": "Lack analysis",
+            "displayName": "Missing analysis",
+            "kind": "gap-signal",
+            "visibility": "internal"
+          }
+        },
         "relations": {
           "affectedAsset": {
             "type": "manyToOne",
@@ -1328,7 +2531,7 @@
               "path": "data.assetIps"
             },
             "defaultMode": "array",
-            "defaultArrayProperty": "associatedAssets",
+            "defaultArrayProperty": "associatedAssetsSnapshots",
             "targetFields": [
               "ipAddress",
               "hostName",
@@ -1349,7 +2552,7 @@
               "path": "data.name"
             },
             "defaultMode": "array",
-            "defaultArrayProperty": "associatedData",
+            "defaultArrayProperty": "associatedVulnerabilitiesGroupsSnapshots",
             "targetFields": [
               "name",
               "severity",
@@ -1406,9 +2609,9 @@
             "dataRoot": "data",
             "isCanonical": true
           },
-          "inferences": {
-            "postfix": "inferences",
-            "collection": "vulnerabilities-groups-inferences",
+          "discovery": {
+            "postfix": "discovery",
+            "collection": "vulnerabilities-groups-discovery",
             "dataRoot": "data",
             "isCanonical": false
           },
@@ -1484,103 +2687,323 @@
             "list": true,
             "item": true,
             "valueType": "number"
-          }
-        },
-        "associatedProperties": [],
-        "relations": {
-          "groupVulnerabilities": {
-            "type": "oneToMany",
-            "source": {
-              "contentType": "snapshots",
-              "path": "data.name"
-            },
-            "target": {
-              "contentType": "snapshots",
-              "path": "data.vulnerabilityName"
-            },
-            "defaultMode": "array",
-            "defaultArrayProperty": "vulnerabilities",
-            "targetFields": [
-              "assetIp",
-              "severity",
-              "cveId",
-              "pluginName"
-            ],
-            "targetObjectType": "vulnerabilities"
-          }
-        },
-        "schemaVersion": "memorix.objectTypeDescriptor.v2",
-        "objectType": "vulnerabilities-groups"
-      }
-    },
-    {
-      "catalogId": "memorix-object-type-descriptors",
-      "scope": {
-        "domains": [
-          "network",
-          "vulnerabilities"
-        ],
-        "agents": [
-          "neo"
-        ]
-      },
-      "data": {
-        "id": "knowledge-playbooks",
-        "defaultListDescriptorId": "knowledge-playbooks-main-list",
-        "defaultItemDescriptorId": "knowledge-playbook-detail-item",
-        "target": "knowledge",
-        "collectionPrefix": "knowledge-playbooks",
-        "identity": {
-          "allowedIdFields": [
-            "knowledgeId"
-          ],
-          "requiredExactlyOne": true,
-          "defaultIdField": "knowledgeId"
-        },
-        "defaults": {
-          "canonicalContentType": "snapshots",
-          "dataRoot": "data",
-          "effectiveDatePath": "capturedAt"
-        },
-        "contentTypes": {
-          "snapshots": {
-            "postfix": "snapshots",
-            "collection": "knowledge-playbooks-snapshots",
-            "dataRoot": "data",
-            "isCanonical": true,
-            "effectiveDatePath": "capturedAt"
-          }
-        },
-        "properties": {
-          "title": {
-            "label": "Title",
+          },
+          "affectedEntitiesCount": {
+            "label": "Affected #",
             "source": {
               "contentType": "snapshots",
-              "path": "data.title"
+              "path": "analytics.affectedAssets.total"
             },
             "humanReadable": true,
             "sortable": true,
-            "filterable": true,
+            "filterable": false,
             "list": true,
             "item": true,
-            "valueType": "string"
+            "valueType": "number",
+            "format": "count"
           },
-          "summary": {
-            "label": "Summary",
+          "findingsCount": {
+            "label": "Findings #",
             "source": {
               "contentType": "snapshots",
-              "path": "data.summary"
+              "path": "analytics.findings.total"
             },
             "humanReadable": true,
-            "sortable": false,
+            "sortable": true,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "number",
+            "format": "count"
+          },
+          "vulnerabilitiesCount": {
+            "label": "Vulnerabilities #",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.total"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "number",
+            "format": "count"
+          },
+          "criticalVulnerabilities": {
+            "label": "Critical Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.critical"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "highVulnerabilities": {
+            "label": "High Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.high"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "mediumVulnerabilities": {
+            "label": "Medium Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.medium"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "lowVulnerabilities": {
+            "label": "Low Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.low"
+            },
+            "humanReadable": true,
+            "sortable": true,
             "filterable": false,
             "list": true,
             "item": true,
+            "valueType": "number"
+          },
+          "riskLevel": {
+            "label": "Risk Level",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.enrichment.riskLevel"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "priorityScore": {
+            "label": "Priority Score",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.enrichment.priorityScore"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "knownExploited": {
+            "label": "Known Exploited (KEV)",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.enrichment.knownExploited"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "vulnerabilityType": {
+            "label": "Type",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.vulnerability_type"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefSummary": {
+            "label": "Brief Summary",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.summary"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefAnalysis": {
+            "label": "Brief Analysis",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.analysis"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefEvidence": {
+            "label": "Brief Evidence",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.evidence"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefGaps": {
+            "label": "Brief Gaps",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.gaps"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
             "valueType": "string"
+          },
+          "analysisApplicability": {
+            "label": "Applicability",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.applicability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisExploitability": {
+            "label": "Exploitability",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.exploitability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisImpact": {
+            "label": "Impact",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.impact"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisThreat": {
+            "label": "Threat",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.threat"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisMitre": {
+            "label": "MITRE",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.mitre"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "array"
+          }
+        },
+        "associatedProperties": [],
+        "narratives": {
+          "has-none-severity": {
+            "label": "None severity",
+            "kind": "association-common-property",
+            "sourceRef": "severity",
+            "property": "severity",
+            "value": "none"
+          },
+          "has-low-severity": {
+            "label": "Low severity",
+            "kind": "association-common-property",
+            "sourceRef": "severity",
+            "property": "severity",
+            "value": "low"
+          },
+          "has-medium-severity": {
+            "label": "Medium severity",
+            "kind": "association-common-property",
+            "sourceRef": "severity",
+            "property": "severity",
+            "value": "medium"
+          },
+          "has-high-severity": {
+            "label": "High severity",
+            "kind": "association-common-property",
+            "sourceRef": "severity",
+            "property": "severity",
+            "value": "high"
+          },
+          "has-critical-severity": {
+            "label": "Critical severity",
+            "kind": "association-common-property",
+            "sourceRef": "severity",
+            "property": "severity",
+            "value": "critical"
+          }
+        },
+        "processing": {
+          "associatedContent": {
+            "rollParentSnapshots": false,
+            "excludePostfixes": [
+              "raw"
+            ]
+          }
+        },
+        "relations": {
+          "groupVulnerabilities": {
+            "type": "oneToMany",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.name"
+            },
+            "target": {
+              "contentType": "snapshots",
+              "path": "data.vulnerabilityName"
+            },
+            "defaultMode": "array",
+            "defaultArrayProperty": "vulnerabilities",
+            "targetFields": [
+              "assetIp",
+              "severity",
+              "cveId",
+              "pluginName"
+            ],
+            "targetObjectType": "vulnerabilities"
           }
         },
         "schemaVersion": "memorix.objectTypeDescriptor.v2",
-        "objectType": "knowledge-playbooks"
+        "objectType": "vulnerabilities-groups"
       }
     },
     {
@@ -1595,11 +3018,11 @@
         ]
       },
       "data": {
-        "id": "content-documents",
-        "defaultListDescriptorId": "content-documents-main-list",
-        "defaultItemDescriptorId": "content-document-detail-item",
+        "id": "knowledge-playbooks",
+        "defaultListDescriptorId": "knowledge-playbooks-main-list",
+        "defaultItemDescriptorId": "knowledge-playbook-detail-item",
         "target": "knowledge",
-        "collectionPrefix": "content-documents",
+        "collectionPrefix": "knowledge-playbooks",
         "identity": {
           "allowedIdFields": [
             "knowledgeId"
@@ -1615,24 +3038,9 @@
         "contentTypes": {
           "snapshots": {
             "postfix": "snapshots",
-            "collection": "content-documents-snapshots",
+            "collection": "knowledge-playbooks-snapshots",
             "dataRoot": "data",
             "isCanonical": true,
-            "cardinality": "1:1",
-            "effectiveDatePath": "capturedAt"
-          },
-          "extractions": {
-            "postfix": "extractions",
-            "collection": "content-documents-extractions",
-            "dataRoot": "data",
-            "cardinality": "1:n",
-            "effectiveDatePath": "capturedAt"
-          },
-          "chunks": {
-            "postfix": "chunks",
-            "collection": "content-documents-chunks",
-            "dataRoot": "data",
-            "cardinality": "1:n",
             "effectiveDatePath": "capturedAt"
           }
         },
@@ -1662,24 +3070,109 @@
             "list": true,
             "item": true,
             "valueType": "string"
-          },
-          "language": {
-            "label": "Language",
-            "source": {
-              "contentType": "snapshots",
-              "path": "data.language"
-            },
-            "humanReadable": true,
-            "sortable": true,
-            "filterable": true,
-            "list": true,
-            "item": true,
-            "valueType": "string"
-          },
-          "sourceKind": {
-            "label": "Source kind",
-            "source": {
-              "contentType": "snapshots",
+          }
+        },
+        "schemaVersion": "memorix.objectTypeDescriptor.v2",
+        "objectType": "knowledge-playbooks"
+      }
+    },
+    {
+      "catalogId": "memorix-object-type-descriptors",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "content-documents",
+        "defaultListDescriptorId": "content-documents-main-list",
+        "defaultItemDescriptorId": "content-document-detail-item",
+        "target": "knowledge",
+        "collectionPrefix": "content-documents",
+        "identity": {
+          "allowedIdFields": [
+            "knowledgeId"
+          ],
+          "requiredExactlyOne": true,
+          "defaultIdField": "knowledgeId"
+        },
+        "defaults": {
+          "canonicalContentType": "snapshots",
+          "dataRoot": "data",
+          "effectiveDatePath": "capturedAt"
+        },
+        "contentTypes": {
+          "snapshots": {
+            "postfix": "snapshots",
+            "collection": "content-documents-snapshots",
+            "dataRoot": "data",
+            "isCanonical": true,
+            "cardinality": "1:1",
+            "effectiveDatePath": "capturedAt"
+          },
+          "extractions": {
+            "postfix": "extractions",
+            "collection": "content-documents-extractions",
+            "dataRoot": "data",
+            "cardinality": "1:n",
+            "effectiveDatePath": "capturedAt"
+          },
+          "chunks": {
+            "postfix": "chunks",
+            "collection": "content-documents-chunks",
+            "dataRoot": "data",
+            "cardinality": "1:n",
+            "effectiveDatePath": "capturedAt"
+          }
+        },
+        "properties": {
+          "title": {
+            "label": "Title",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.title"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "summary": {
+            "label": "Summary",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.summary"
+            },
+            "humanReadable": true,
+            "sortable": false,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "language": {
+            "label": "Language",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.language"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "sourceKind": {
+            "label": "Source kind",
+            "source": {
+              "contentType": "snapshots",
               "path": "source.kind"
             },
             "humanReadable": true,
@@ -1715,9 +3208,489 @@
             "item": false,
             "valueType": "string"
           }
-        },
-        "schemaVersion": "memorix.objectTypeDescriptor.v2",
-        "objectType": "content-documents"
+        },
+        "schemaVersion": "memorix.objectTypeDescriptor.v2",
+        "objectType": "content-documents"
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "assets-main-list",
+        "entity": "assets",
+        "title": "Assets",
+        "leadingContentType": "snapshots",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [],
+        "fields": [
+          "ipAddress",
+          "subnetIp",
+          "subnetCidr",
+          "hostName",
+          "source",
+          "agentType",
+          "xdrOperationalStatus",
+          "xdrAgentStatus",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "findingsCount",
+          "potentialImpactLevel",
+          "pathsCount",
+          "observedUsers",
+          "lastSeen"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "ipAddress",
+          "subnetIp",
+          "subnetCidr",
+          "hostName",
+          "source",
+          "agentType",
+          "xdrOperationalStatus",
+          "xdrAgentStatus",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "findingsCount",
+          "potentialImpactLevel",
+          "pathsCount",
+          "lastSeen"
+        ],
+        "defaultSort": {
+          "property": "ipAddress",
+          "direction": "asc"
+        },
+        "allowSortDrivenLeadingOverride": false,
+        "columnDrillDowns": [
+          {
+            "field": "criticalVulnerabilities",
+            "label": "Critical Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-critical-severity"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "highVulnerabilities",
+            "label": "High Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-high-severity"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "findingsCount",
+            "label": "Findings",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-observations-list",
+              "narrativeIds": [
+                "is-finding"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          }
+        ]
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "vulnerable-assets-list",
+        "entity": "assets",
+        "title": "Vulnerable Assets",
+        "leadingContentType": "snapshots",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [
+          {
+            "property": "narrativeId",
+            "operator": "ne",
+            "value": "has-no-vulnerabilities"
+          }
+        ],
+        "fields": [
+          "ipAddress",
+          "hostName",
+          "source",
+          "pathsCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "findingsCount",
+          "agentType",
+          "xdrAgentStatus",
+          "xdrOperationalStatus",
+          "observedUsers",
+          "lastSeen"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "ipAddress",
+          "hostName",
+          "source",
+          "pathsCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "findingsCount",
+          "agentType",
+          "xdrAgentStatus",
+          "xdrOperationalStatus",
+          "lastSeen"
+        ],
+        "defaultSort": {
+          "property": "ipAddress",
+          "direction": "asc"
+        },
+        "allowSortDrivenLeadingOverride": false,
+        "columnDrillDowns": [
+          {
+            "field": "criticalVulnerabilities",
+            "label": "Critical Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-critical-severity"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "highVulnerabilities",
+            "label": "High Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-high-severity"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "findingsCount",
+            "label": "Findings",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-observations-list",
+              "narrativeIds": [
+                "is-finding"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          }
+        ]
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "assets-exploitability-decisions-list",
+        "entity": "assets",
+        "title": "Assets Exploitability",
+        "leadingContentType": "decisions",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [],
+        "fields": [
+          "decisionOverviewSummary",
+          "decisionOverviewDetailedAnalysis",
+          "decisionLabel",
+          "decisionStatus",
+          "decisionRiskScore",
+          "decisionUrgencyScore"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "decisionRiskScore",
+          "decisionUrgencyScore",
+          "decisionStatus",
+          "decisionLabel"
+        ],
+        "defaultSort": {
+          "property": "decisionRiskScore",
+          "direction": "desc"
+        },
+        "allowSortDrivenLeadingOverride": false
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "assets-potential-impact-decisions-list",
+        "entity": "assets",
+        "title": "Asset's Potential Impact",
+        "leadingContentType": "decisions",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [],
+        "fields": [
+          "decisionOverviewSummary",
+          "decisionOverviewDetailedAnalysis",
+          "decisionLabel",
+          "decisionStatus",
+          "decisionRiskScore"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "decisionRiskScore",
+          "decisionStatus",
+          "decisionLabel"
+        ],
+        "defaultSort": {
+          "property": "decisionRiskScore",
+          "direction": "desc"
+        },
+        "allowSortDrivenLeadingOverride": false
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "subnets-main-list",
+        "entity": "subnets",
+        "title": "Networks",
+        "leadingContentType": "snapshots",
+        "fields": [
+          "subnetIp",
+          "cidr",
+          "zone",
+          "zoneClass",
+          "vr",
+          "networkAddress",
+          "assetsCount",
+          "findingsCount",
+          "vulnerabilitiesCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "outsideExposureClass",
+          "internalReachabilityClass",
+          "recordId"
+        ],
+        "defaultSort": {
+          "property": "cidr",
+          "direction": "asc"
+        },
+        "allowedSorts": [
+          "subnetIp",
+          "cidr",
+          "zone",
+          "zoneClass",
+          "vr",
+          "assetsCount",
+          "findingsCount",
+          "vulnerabilitiesCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "outsideExposureClass",
+          "internalReachabilityClass"
+        ],
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "columnDrillDowns": [
+          {
+            "field": "assetsCount",
+            "label": "Assets #",
+            "listQuery": {
+              "entityName": "assets",
+              "listDescriptorId": "assets-main-list",
+              "filters": [
+                {
+                  "property": "subnetCidrs",
+                  "operator": "eq",
+                  "valueFromRow": "cidr"
+                }
+              ]
+            }
+          },
+          {
+            "field": "findingsCount",
+            "label": "Findings #",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-observations-list",
+              "narrativeIds": [
+                "is-finding"
+              ],
+              "filters": [
+                {
+                  "property": "subnetIp",
+                  "operator": "eq",
+                  "valueFromRow": "networkAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "vulnerabilitiesCount",
+            "label": "Vulnerabilities #",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability"
+              ],
+              "filters": [
+                {
+                  "property": "subnetIp",
+                  "operator": "eq",
+                  "valueFromRow": "networkAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "criticalVulnerabilities",
+            "label": "Critical Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-critical-severity"
+              ],
+              "filters": [
+                {
+                  "property": "subnetIp",
+                  "operator": "eq",
+                  "valueFromRow": "networkAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "highVulnerabilities",
+            "label": "High Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-high-severity"
+              ],
+              "filters": [
+                {
+                  "property": "subnetIp",
+                  "operator": "eq",
+                  "valueFromRow": "networkAddress"
+                }
+              ]
+            }
+          }
+        ]
       }
     },
     {
@@ -1732,52 +3705,57 @@
         ]
       },
       "data": {
-        "id": "assets-main-list",
-        "entity": "assets",
-        "title": "Assets",
+        "id": "vulnerabilities-main-list",
+        "entity": "vulnerabilities",
+        "title": "Vulnerabilities",
         "leadingContentType": "snapshots",
         "pagination": {
           "enabled": true,
           "defaultLimit": 50,
           "maxLimit": 200
         },
-        "filters": [],
+        "filters": [
+          {
+            "property": "narrativeId",
+            "operator": "eq",
+            "value": "is-vulnerability"
+          }
+        ],
         "fields": [
-          "ipAddress",
+          "vulnerabilityId",
+          "assetIp",
           "subnetIp",
-          "subnetCidr",
-          "hostName",
-          "source",
-          "agentType",
-          "xdrOperationalStatus",
-          "xdrAgentStatus",
-          "hasVulnerabilities",
-          "criticalVulnerabilities",
-          "highVulnerabilities",
-          "potentialImpactLevel",
-          "pathsCount"
+          "pluginName",
+          "pluginFamily",
+          "severity",
+          "cveId",
+          "riskLevel",
+          "priorityScore",
+          "epss",
+          "knownExploited",
+          "exploitabilityLevel",
+          "networkExposure"
         ],
         "extensions": [],
         "includeRelations": [],
         "allowedSorts": [
-          "ipAddress",
+          "vulnerabilityId",
+          "assetIp",
           "subnetIp",
-          "subnetCidr",
-          "hostName",
-          "source",
-          "agentType",
-          "xdrOperationalStatus",
-          "xdrAgentStatus",
-          "hasVulnerabilities",
-          "criticalVulnerabilities",
-          "highVulnerabilities",
-          "potentialImpactLevel",
-          "pathsCount",
-          "lastSeen"
+          "pluginName",
+          "pluginFamily",
+          "severity",
+          "riskLevel",
+          "priorityScore",
+          "epss",
+          "knownExploited",
+          "exploitabilityScore",
+          "exploitabilityLevel",
+          "networkExposure"
         ],
         "defaultSort": {
-          "property": "ipAddress",
-          "direction": "asc"
+          "property": "priorityScore",
+          "direction": "desc"
         },
         "allowSortDrivenLeadingOverride": false
       }
@@ -1794,26 +3772,88 @@
         ]
       },
       "data": {
-        "id": "subnets-main-list",
-        "entity": "subnets",
-        "title": "Subnets",
+        "id": "vulnerabilities-observations-list",
+        "entity": "vulnerabilities",
+        "title": "Observations",
         "leadingContentType": "snapshots",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [
+          {
+            "property": "narrativeId",
+            "operator": "eq",
+            "value": "is-finding"
+          }
+        ],
         "fields": [
-          "cidr",
-          "subnetIp",
-          "zone",
-          "vr",
-          "recordId"
+          "assetIp",
+          "pluginName",
+          "severity",
+          "riskLevel",
+          "priorityScore",
+          "knownExploited",
+          "cveId",
+          "subnetIp"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "assetIp",
+          "pluginName",
+          "severity",
+          "riskLevel",
+          "priorityScore",
+          "knownExploited"
         ],
         "defaultSort": {
-          "property": "cidr",
+          "property": "pluginName",
           "direction": "asc"
         },
+        "allowSortDrivenLeadingOverride": false
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "vulnerabilities-exploitability-analysis-list",
+        "entity": "vulnerabilities",
+        "title": "Vulnerabilities Exploitability",
+        "leadingContentType": "analysis",
         "pagination": {
           "enabled": true,
           "defaultLimit": 50,
           "maxLimit": 200
-        }
+        },
+        "filters": [],
+        "fields": [
+          "analysisBriefSummary",
+          "analysisBriefAnalysis",
+          "analysisExploitabilityLevel",
+          "analysisClassType"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "analysisExploitabilityLevel",
+          "analysisClassType"
+        ],
+        "defaultSort": {
+          "property": "analysisExploitabilityLevel",
+          "direction": "asc"
+        },
+        "allowSortDrivenLeadingOverride": false
       }
     },
     {
@@ -1828,9 +3868,51 @@
         ]
       },
       "data": {
-        "id": "vulnerabilities-main-list",
+        "id": "vulnerabilities-triage-analysis-list",
         "entity": "vulnerabilities",
-        "title": "Vulnerabilities",
+        "title": "Vulnerabilities Triage",
+        "leadingContentType": "analysis",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [],
+        "fields": [
+          "analysisBriefSummary",
+          "analysisBriefAnalysis",
+          "analysisExploitabilityLevel",
+          "analysisClassType",
+          "analysisImpact"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "analysisExploitabilityLevel",
+          "analysisClassType"
+        ],
+        "defaultSort": {
+          "property": "analysisExploitabilityLevel",
+          "direction": "asc"
+        },
+        "allowSortDrivenLeadingOverride": false
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "vulnerabilities-groups-main-list",
+        "entity": "vulnerabilities-groups",
+        "title": "Vulnerability Groups",
         "leadingContentType": "snapshots",
         "pagination": {
           "enabled": true,
@@ -1839,40 +3921,97 @@
         },
         "filters": [],
         "fields": [
-          "vulnerabilityId",
-          "assetIp",
-          "pluginName",
-          "pluginFamily",
+          "name",
+          "vulnerabilityType",
           "severity",
-          "cveId",
+          "affectedEntitiesCount",
+          "findingsCount",
+          "vulnerabilitiesCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
           "riskLevel",
           "priorityScore",
-          "epss",
           "knownExploited",
-          "exploitabilityLevel",
-          "networkExposure"
+          "cveId",
+          "pluginId",
+          "compositeScore"
         ],
         "extensions": [],
         "includeRelations": [],
         "allowedSorts": [
-          "vulnerabilityId",
-          "assetIp",
-          "pluginName",
-          "pluginFamily",
+          "name",
           "severity",
+          "affectedEntitiesCount",
+          "findingsCount",
+          "vulnerabilitiesCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
           "riskLevel",
           "priorityScore",
-          "epss",
           "knownExploited",
-          "exploitabilityScore",
-          "exploitabilityLevel",
-          "networkExposure"
+          "compositeScore"
         ],
         "defaultSort": {
           "property": "priorityScore",
           "direction": "desc"
         },
-        "allowSortDrivenLeadingOverride": false
+        "allowSortDrivenLeadingOverride": false,
+        "columnDrillDowns": [
+          {
+            "field": "affectedEntitiesCount",
+            "label": "Affected #",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability"
+              ],
+              "filters": [
+                {
+                  "property": "pluginName",
+                  "operator": "eq",
+                  "valueFromRow": "name"
+                }
+              ]
+            }
+          },
+          {
+            "field": "findingsCount",
+            "label": "Findings #",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-observations-list",
+              "narrativeIds": [
+                "is-finding"
+              ],
+              "filters": [
+                {
+                  "property": "pluginName",
+                  "operator": "eq",
+                  "valueFromRow": "name"
+                }
+              ]
+            }
+          },
+          {
+            "field": "vulnerabilitiesCount",
+            "label": "Vulnerabilities #",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability"
+              ],
+              "filters": [
+                {
+                  "property": "pluginName",
+                  "operator": "eq",
+                  "valueFromRow": "name"
+                }
+              ]
+            }
+          }
+        ]
       }
     },
     {
@@ -2104,20 +4243,95 @@
         },
         "contentTypes": [
           {
-            "contentType": "snapshots",
-            "required": true,
-            "multiMatch": {
-              "strategy": "last",
-              "effectiveDatePath": "data.lastSeen",
-              "fallbackEffectiveDatePaths": [
-                "capturedAt",
-                "snapshot.capturedAt",
-                "data.lastSeen"
-              ]
-            }
-          }
-        ],
-        "sections": [
+            "contentType": "snapshots",
+            "required": true,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "data.lastSeen",
+              "fallbackEffectiveDatePaths": [
+                "capturedAt",
+                "snapshot.capturedAt",
+                "data.lastSeen"
+              ]
+            }
+          },
+          {
+            "contentType": "analysis",
+            "required": false,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt"
+              ]
+            }
+          },
+          {
+            "contentType": "decisions",
+            "required": false,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt"
+              ]
+            }
+          }
+        ],
+        "sections": [
+          {
+            "id": "brief",
+            "title": "Brief",
+            "fields": [
+              "analysisBriefSummary",
+              "analysisBriefTakeaway",
+              "analysisBriefConfidence"
+            ]
+          },
+          {
+            "id": "context",
+            "title": "Context",
+            "fields": [
+              "analysisContext"
+            ]
+          },
+          {
+            "id": "reachability",
+            "title": "Reachability",
+            "fields": [
+              "analysisReachability"
+            ]
+          },
+          {
+            "id": "paths",
+            "title": "Paths",
+            "fields": [
+              "analysisPaths",
+              "attackPathExistence",
+              "pathsCount"
+            ]
+          },
+          {
+            "id": "exploitability",
+            "title": "Exploitability",
+            "fields": [
+              "decisionExploitability"
+            ]
+          },
+          {
+            "id": "decision",
+            "title": "Decision",
+            "fields": [
+              "decisionOverviewSummary",
+              "decisionOverviewDetailedAnalysis",
+              "decisionLabel",
+              "decisionStatus",
+              "decisionRiskScore",
+              "decisionUrgencyScore"
+            ]
+          },
           {
             "id": "summary",
             "title": "Summary",
@@ -2130,6 +4344,7 @@
               "agentType",
               "xdrOperationalStatus",
               "xdrAgentStatus",
+              "observedUsers",
               "lastSeen",
               "pathsCount"
             ]
@@ -2138,11 +4353,11 @@
             "id": "vulnerabilitySummary",
             "title": "Vulnerability Summary",
             "fields": [
-              "hasVulnerabilities",
               "criticalVulnerabilities",
               "highVulnerabilities",
               "mediumVulnerabilities",
-              "lowVulnerabilities"
+              "lowVulnerabilities",
+              "findingsCount"
             ]
           },
           {
@@ -2153,13 +4368,6 @@
               "potentialImpactConfidence",
               "potentialImpactStory"
             ]
-          },
-          {
-            "id": "xdr",
-            "title": "XDR",
-            "fields": [
-              "rawXdr"
-            ]
           }
         ],
         "includeRelations": [
@@ -2225,6 +4433,18 @@
               ]
             }
           },
+          {
+            "contentType": "analysis",
+            "required": false,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt"
+              ]
+            }
+          },
           {
             "contentType": "legacy",
             "required": false,
@@ -2239,6 +4459,57 @@
           }
         ],
         "sections": [
+          {
+            "id": "overview",
+            "title": "Overview",
+            "fields": [
+              "analysisOverview",
+              "analysisOverviewSummary"
+            ]
+          },
+          {
+            "id": "role",
+            "title": "Role",
+            "fields": [
+              "analysisRole"
+            ]
+          },
+          {
+            "id": "exposure",
+            "title": "Exposure",
+            "fields": [
+              "analysisExposure",
+              "outsideExposureClass"
+            ]
+          },
+          {
+            "id": "trust",
+            "title": "Trust",
+            "fields": [
+              "analysisTrust"
+            ]
+          },
+          {
+            "id": "attack-path",
+            "title": "Attack Path",
+            "fields": [
+              "analysisAttackPath"
+            ]
+          },
+          {
+            "id": "movement",
+            "title": "Movement",
+            "fields": [
+              "analysisMovement"
+            ]
+          },
+          {
+            "id": "context",
+            "title": "Context",
+            "fields": [
+              "analysisContext"
+            ]
+          },
           {
             "id": "summary",
             "title": "Summary",
@@ -2248,6 +4519,11 @@
               "zone",
               "zoneClass",
               "vr",
+              "assetsCount",
+              "findingsCount",
+              "vulnerabilitiesCount",
+              "criticalVulnerabilities",
+              "highVulnerabilities",
               "recordId"
             ]
           },
@@ -2263,15 +4539,6 @@
               "reachableFromZones",
               "zoneMappingConfidence"
             ]
-          },
-          {
-            "id": "legacy",
-            "title": "Legacy (quarantined)",
-            "fields": [
-              "quarantineLegacy",
-              "legacySubnetIp",
-              "quarantineReason"
-            ]
           }
         ],
         "includeRelations": [],
@@ -2311,61 +4578,84 @@
                 "data.enrichment.enrichedAt"
               ]
             }
+          },
+          {
+            "contentType": "analysis",
+            "required": false,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt"
+              ]
+            }
           }
         ],
         "sections": [
           {
-            "id": "summary",
-            "title": "Summary",
+            "id": "brief",
+            "title": "Brief",
             "fields": [
-              "vulnerabilityId",
-              "pluginName",
-              "pluginFamily",
-              "severity",
-              "cveId"
+              "analysisBriefSummary",
+              "analysisBriefAnalysis",
+              "analysisBriefEvidence",
+              "analysisBriefGaps"
             ]
           },
           {
-            "id": "asset",
-            "title": "Affected Asset",
+            "id": "applicability",
+            "title": "Applicability",
             "fields": [
-              "assetIp",
-              "assetType",
-              "assetZone",
-              "assetHostname",
-              "assetMatched"
+              "analysisApplicability"
             ]
           },
           {
-            "id": "risk",
-            "title": "Risk",
+            "id": "exploitability",
+            "title": "Exploitability",
             "fields": [
-              "riskLevel",
-              "priorityScore",
-              "compositeScore",
-              "exploitabilityScore",
-              "exploitabilityLevel"
+              "analysisExploitability",
+              "analysisExploitabilityLevel"
+            ]
+          },
+          {
+            "id": "impact",
+            "title": "Impact",
+            "fields": [
+              "analysisImpact"
             ]
           },
           {
-            "id": "threatIntelligence",
-            "title": "Threat Intelligence",
+            "id": "threat",
+            "title": "Threat",
             "fields": [
-              "epss",
-              "epssPercentile",
+              "analysisThreat",
               "knownExploited",
-              "cvssBaseScore",
-              "cvssVector"
+              "epss"
             ]
           },
           {
-            "id": "networkAndMitre",
-            "title": "Network & MITRE",
+            "id": "mitre",
+            "title": "Mitre",
             "fields": [
-              "networkExposure",
+              "analysisMitre",
               "mitreTechniques",
               "mitreAnalysis"
             ]
+          },
+          {
+            "id": "summary",
+            "title": "Summary",
+            "fields": [
+              "vulnerabilityId",
+              "pluginName",
+              "pluginFamily",
+              "severity",
+              "cveId",
+              "assetIp",
+              "riskLevel",
+              "priorityScore"
+            ]
           }
         ],
         "includeRelations": [
@@ -2398,6 +4688,188 @@
         }
       }
     },
+    {
+      "catalogId": "memorix-item-descriptors",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "vulnerability-observation-detail-item",
+        "entity": "vulnerabilities",
+        "title": "Observation Detail",
+        "identity": {
+          "idField": "recordId"
+        },
+        "contentTypes": [
+          {
+            "contentType": "snapshots",
+            "required": true,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "data.lastSeen",
+              "fallbackEffectiveDatePaths": [
+                "capturedAt",
+                "snapshot.capturedAt",
+                "data.enrichment.enrichedAt"
+              ]
+            }
+          }
+        ],
+        "sections": [
+          {
+            "id": "brief",
+            "title": "Brief",
+            "fields": [
+              "assetIp",
+              "pluginName",
+              "severity",
+              "cveId",
+              "riskLevel",
+              "priorityScore",
+              "knownExploited"
+            ]
+          }
+        ],
+        "includeRelations": [],
+        "content": {
+          "allowed": false
+        }
+      }
+    },
+    {
+      "catalogId": "memorix-item-descriptors",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "vulnerabilities-group-detail-item",
+        "entity": "vulnerabilities-groups",
+        "title": "Vulnerability Group Detail",
+        "identity": {
+          "idField": "recordId"
+        },
+        "contentTypes": [
+          {
+            "contentType": "snapshots",
+            "required": true,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt",
+                "data.enrichment.enrichedAt"
+              ]
+            }
+          },
+          {
+            "contentType": "analysis",
+            "required": false,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt"
+              ]
+            }
+          }
+        ],
+        "sections": [
+          {
+            "id": "brief",
+            "title": "Brief",
+            "fields": [
+              "analysisBriefSummary",
+              "analysisBriefAnalysis",
+              "analysisBriefEvidence",
+              "analysisBriefGaps"
+            ]
+          },
+          {
+            "id": "applicability",
+            "title": "Applicability",
+            "fields": [
+              "analysisApplicability"
+            ]
+          },
+          {
+            "id": "exploitability",
+            "title": "Exploitability",
+            "fields": [
+              "analysisExploitability"
+            ]
+          },
+          {
+            "id": "impact",
+            "title": "Impact",
+            "fields": [
+              "analysisImpact"
+            ]
+          },
+          {
+            "id": "threat",
+            "title": "Threat",
+            "fields": [
+              "analysisThreat",
+              "knownExploited"
+            ]
+          },
+          {
+            "id": "mitre",
+            "title": "Mitre",
+            "fields": [
+              "analysisMitre"
+            ]
+          },
+          {
+            "id": "summary",
+            "title": "Summary",
+            "fields": [
+              "name",
+              "vulnerabilityType",
+              "cveId",
+              "pluginId",
+              "severity",
+              "affectedEntitiesCount",
+              "findingsCount",
+              "vulnerabilitiesCount",
+              "riskLevel",
+              "priorityScore"
+            ]
+          }
+        ],
+        "includeRelations": [
+          {
+            "relation": "groupVulnerabilities",
+            "mode": "array",
+            "arrayProperty": "vulnerabilities",
+            "limit": 200,
+            "fields": [
+              "assetIp",
+              "severity",
+              "cveId",
+              "pluginName"
+            ]
+          }
+        ],
+        "content": {
+          "allowed": false
+        }
+      }
+    },
     {
       "catalogId": "memorix-item-descriptors",
       "scope": {