@x12i/memorix-retrieval 1.31.0 → 1.32.0

package/catalox-seeds/inputs/entity-descriptors/assets.json

@@ -41,6 +41,18 @@
       "collection": "assets-scoped",
       "dataRoot": "data",
       "isCanonical": false
+    },
+    "analysis": {
+      "postfix": "analysis",
+      "collection": "assets-analysis",
+      "dataRoot": "data",
+      "isCanonical": false
+    },
+    "decisions": {
+      "postfix": "decision",
+      "collection": "assets-decision",
+      "dataRoot": "data",
+      "isCanonical": false
     }
   },
   "properties": {
@@ -213,6 +225,20 @@
       "item": true,
       "valueType": "number"
     },
+    "findingsCount": {
+      "label": "Findings",
+      "source": {
+        "contentType": "snapshots",
+        "path": "analytics.findings.total"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number",
+      "format": "count"
+    },
     "potentialImpactLevel": {
       "label": "Potential Impact",
       "source": {
@@ -277,11 +303,146 @@
       "list": false,
       "item": true,
       "valueType": "object"
+    },
+    "observedUsers": {
+      "label": "Users",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.observedUsers"
+      },
+      "humanReadable": true,
+      "sortable": false,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "array"
+    },
+    "analysisBriefSummary": {
+      "label": "Brief Summary",
+      "source": { "contentType": "analysis", "path": "data.brief.summary" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisBriefTakeaway": {
+      "label": "Brief Takeaway",
+      "source": { "contentType": "analysis", "path": "data.brief.takeaway" },
+      "humanReadable": true,
+      "list": false,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisBriefConfidence": {
+      "label": "Brief Confidence",
+      "source": { "contentType": "analysis", "path": "data.brief.confidence" },
+      "humanReadable": true,
+      "list": false,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisContext": {
+      "label": "Context",
+      "source": { "contentType": "analysis", "path": "data.context" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisReachability": {
+      "label": "Reachability",
+      "source": { "contentType": "analysis", "path": "data.reachability" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisPaths": {
+      "label": "Paths",
+      "source": { "contentType": "analysis", "path": "data.paths" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "attackPathExistence": {
+      "label": "Attack Path Existence",
+      "source": { "contentType": "analysis", "path": "data.paths.attackPathExistence" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "decisionOverviewSummary": {
+      "label": "Decision Summary",
+      "source": { "contentType": "decisions", "path": "data.overview.summary" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "decisionOverviewDetailedAnalysis": {
+      "label": "Decision Detailed Analysis",
+      "source": { "contentType": "decisions", "path": "data.overview.detailedAnalysis" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "decisionExploitability": {
+      "label": "Exploitability Analysis",
+      "source": { "contentType": "decisions", "path": "data.exploitability" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "decisionLabel": {
+      "label": "Decision",
+      "source": { "contentType": "decisions", "path": "data.decision.decision" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "decisionStatus": {
+      "label": "Decision Status",
+      "source": { "contentType": "decisions", "path": "data.decision.status" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "decisionRiskScore": {
+      "label": "Decision Score",
+      "source": { "contentType": "decisions", "path": "data.decision.riskScore" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "decisionUrgencyScore": {
+      "label": "Urgency Score",
+      "source": { "contentType": "decisions", "path": "data.decision.urgencyScore" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
     }
   },
   "associatedProperties": [
     {
-      "name": "associatedData",
+      "name": "associatedSubnetsSnapshots",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -293,7 +454,7 @@
       "sourceCollection": "subnets-snapshots"
     },
     {
-      "name": "associatedDiscovery",
+      "name": "associatedSubnetsDiscovery",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -305,7 +466,7 @@
       "sourceCollection": "subnets-discovery"
     },
     {
-      "name": "associatedSiblings",
+      "name": "associatedAssetsSnapshots",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -329,7 +490,7 @@
       "sourceCollection": "subnets-snapshots"
     },
     {
-      "name": "associatedSubnets",
+      "name": "associatedSubnetsSnapshots",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -363,6 +524,44 @@
       "managed": true,
       "refreshRuleKey": "assets.subnets.analysis.explicit.by-cidr",
       "sourceCollection": "subnets-analysis"
+    },
+    {
+      "name": "associatedTopologyZonesAnalysis",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "topology-zones",
+      "linkedContentType": "analysis",
+      "description": "Zone cyber-analysis payloads joined by host data.zones or associatedTopology.zone to topology-zones-analysis.data.name.",
+      "managed": true,
+      "refreshRuleKey": "assets.topology-zones.analysis.by-zone-name",
+      "sourceCollection": "topology-zones-analysis"
+    },
+    {
+      "name": "associatedVulnerabilitiesAnalysis",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities",
+      "linkedContentType": "analysis",
+      "description": "Vulnerability analysis payloads copied from vulnerabilities-analysis.data after matching vulnerabilities-snapshots by asset IP and resolving content by snapshot recordId.",
+      "managed": true,
+      "refreshRuleKey": "assets.vulnerabilities.analysis.by-assetIp",
+      "sourceCollection": "vulnerabilities-analysis"
+    },
+    {
+      "name": "associatedTopVulnerabilitiesAnalysis",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities",
+      "linkedContentType": "analysis",
+      "description": "Top vulnerability analysis payloads (default 5), ranked by vulnerabilities-snapshots.data.severity after IP match and content resolve by snapshot recordId. Omitted when empty.",
+      "managed": true,
+      "top": true,
+      "maxItems": 5,
+      "refreshRuleKey": "assets.vulnerabilities.analysis.top.by-assetIp",
+      "sourceCollection": "vulnerabilities-analysis"
     }
   ],
   "processing": {
@@ -390,32 +589,138 @@
         "kind": "function",
         "config": {
           "mode": "resolve",
-          "assetIpPaths": ["data.assetIps", "data.assetIp"],
+          "assetIpPaths": [
+            "data.assetIps",
+            "data.assetIp"
+          ],
           "canonicalCollection": {
             "db": "neo-memorix-entities",
             "collection": "subnets-snapshots"
           }
         }
+      },
+      {
+        "processorId": "assets.topology-extractor",
+        "resolverType": "topology-extractor",
+        "kind": "function",
+        "config": {
+          "mode": "from-associated-data",
+          "sourcePaths": [
+            "associatedSubnetsSnapshots"
+          ],
+          "outputPath": "associatedTopology"
+        }
       }
     ],
     "associatedContent": {
       "rollParentSnapshots": true,
-      "excludePostfixes": ["raw"]
+      "excludePostfixes": [
+        "raw"
+      ]
     }
   },
   "narratives": {
     "has-vulnerabilities": {
       "label": "Has vulnerabilities",
+      "displayName": "Has vulnerabilities",
       "kind": "having-signal",
+      "visibility": "user",
       "sourceRef": "assetVulnerabilities",
       "targetEntity": "vulnerabilities"
     },
     "has-medium-vulnerabilities": {
+      "label": "Has medium vulnerabilities",
+      "displayName": "Medium vulnerabilities",
       "kind": "association-common-property",
+      "visibility": "user",
       "sourceRef": "assetVulnerabilities",
       "targetEntity": "vulnerabilities",
       "property": "severity",
       "value": "medium"
+    },
+    "is-triaged": {
+      "label": "Is triaged",
+      "displayName": "Triaged",
+      "kind": "product-narrative",
+      "visibility": "user"
+    },
+    "has-triage-decision": {
+      "label": "Has triage decision",
+      "displayName": "Has triage decision",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-no-vulnerabilities": {
+      "label": "No vulnerabilities",
+      "displayName": "No vulnerabilities",
+      "kind": "product-narrative",
+      "visibility": "user"
+    },
+    "has-accept-decision": {
+      "label": "Accept",
+      "displayName": "Accept Risk",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-mitigate-decision": {
+      "label": "Mitigate",
+      "displayName": "Mitigate",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-high-or-critical-exploitability": {
+      "label": "High or critical exploitability",
+      "displayName": "High exploitability",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-lateral-movement-risk": {
+      "label": "Lateral movement risk",
+      "displayName": "Lateral movement risk",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-critical-predicted-impact": {
+      "label": "Critical predicted impact",
+      "displayName": "Critical impact",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-high-predicted-impact": {
+      "label": "High predicted impact",
+      "displayName": "High impact",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-medium-predicted-impact": {
+      "label": "Medium predicted impact",
+      "displayName": "Medium impact",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-low-predicted-impact": {
+      "label": "Low predicted impact",
+      "displayName": "Low impact",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-palo-alto-firewall-source": {
+      "label": "Palo Alto Firewall",
+      "displayName": "Palo Alto Firewall",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-palo-alto-xdr-source": {
+      "label": "Palo Alto XDR",
+      "displayName": "Palo Alto XDR",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-tenable-nessus-source": {
+      "label": "Tenable Nessus",
+      "displayName": "Tenable Nessus",
+      "kind": "rollup",
+      "visibility": "user"
     }
   },
   "relations": {
@@ -431,7 +736,7 @@
         "path": "data.cidr"
       },
       "defaultMode": "array",
-      "defaultArrayProperty": "associatedData",
+      "defaultArrayProperty": "associatedSubnetsSnapshots",
       "targetFields": [
         "cidr",
         "networkAddress",

package/catalox-seeds/inputs/entity-descriptors/subnets.json

@@ -43,6 +43,12 @@
       "postfix": "legacy",
       "collection": "subnets-legacy",
       "isCanonical": false
+    },
+    "analysis": {
+      "postfix": "analysis",
+      "collection": "subnets-analysis",
+      "dataRoot": "data",
+      "isCanonical": false
     }
   },
   "rootProperties": {
@@ -279,6 +285,100 @@
       "item": true,
       "valueType": "string"
     },
+    "assetsCount": {
+      "label": "Assets #",
+      "source": {
+        "contentType": "snapshots",
+        "path": "analytics.assets.total"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number",
+      "format": "count"
+    },
+    "findingsCount": {
+      "label": "Findings #",
+      "source": {
+        "contentType": "snapshots",
+        "path": "analytics.findings.total"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number",
+      "format": "count"
+    },
+    "vulnerabilitiesCount": {
+      "label": "Vulnerabilities #",
+      "source": {
+        "contentType": "snapshots",
+        "path": "analytics.vulnerabilities.total"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number",
+      "format": "count"
+    },
+    "criticalVulnerabilities": {
+      "label": "Critical Vulnerabilities",
+      "source": {
+        "contentType": "snapshots",
+        "path": "analytics.vulnerabilities.critical"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "highVulnerabilities": {
+      "label": "High Vulnerabilities",
+      "source": {
+        "contentType": "snapshots",
+        "path": "analytics.vulnerabilities.high"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "mediumVulnerabilities": {
+      "label": "Medium Vulnerabilities",
+      "source": {
+        "contentType": "snapshots",
+        "path": "analytics.vulnerabilities.medium"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "lowVulnerabilities": {
+      "label": "Low Vulnerabilities",
+      "source": {
+        "contentType": "snapshots",
+        "path": "analytics.vulnerabilities.low"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
     "quarantineReason": {
       "label": "Quarantine Reason",
       "source": {
@@ -291,11 +391,75 @@
       "list": false,
       "item": true,
       "valueType": "string"
+    },
+    "analysisOverview": {
+      "label": "Overview",
+      "source": { "contentType": "analysis", "path": "data.overview" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisOverviewSummary": {
+      "label": "Overview Summary",
+      "source": { "contentType": "analysis", "path": "data.overview.summary" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisRole": {
+      "label": "Role",
+      "source": { "contentType": "analysis", "path": "data.cyberRoleInterpretation" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisExposure": {
+      "label": "Exposure",
+      "source": { "contentType": "analysis", "path": "data.externalAndLowerTrustReachability" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisTrust": {
+      "label": "Trust",
+      "source": { "contentType": "analysis", "path": "data.trustPositionInterpretation" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisAttackPath": {
+      "label": "Attack Path",
+      "source": { "contentType": "analysis", "path": "data.possibleAttackPathAnalysis" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisMovement": {
+      "label": "Movement",
+      "source": { "contentType": "analysis", "path": "data.outboundAndBlastPathInterpretation" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisContext": {
+      "label": "Context",
+      "source": { "contentType": "analysis", "path": "data.aggregateContextInterpretation" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
     }
   },
   "associatedProperties": [
     {
-      "name": "associatedChildren",
+      "name": "associatedAssetsSnapshots",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -305,6 +469,18 @@
       "managed": true,
       "refreshRuleKey": "subnets.assets.snapshots.by-cidr",
       "sourceCollection": "assets-snapshots"
+    },
+    {
+      "name": "associatedTopologyZonesAnalysis",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "topology-zones",
+      "linkedContentType": "analysis",
+      "description": "Zone cyber-analysis joined from subnet data.zone to topology-zones-analysis.data.name.",
+      "managed": true,
+      "refreshRuleKey": "subnets.topology-zones.analysis.by-zone-name",
+      "sourceCollection": "topology-zones-analysis"
     }
   ],
   "processing": {
@@ -325,6 +501,33 @@
         }
       }
     ],
+    "resolvers": [
+      {
+        "processorId": "subnets.subnet-key",
+        "resolverType": "subnet-key",
+        "kind": "function",
+        "config": {
+          "mode": "from-cidr",
+          "sourcePath": "data.cidr"
+        }
+      },
+      {
+        "processorId": "subnets.zone-from-topology",
+        "resolverType": "zone-from-topology",
+        "kind": "function",
+        "config": {
+          "onlyWhenZoneIs": "UNKNOWN",
+          "topologyRaw": {
+            "db": "memorix-knowledge",
+            "collection": "topology-raw"
+          },
+          "zonesRegistry": {
+            "db": "neo-memorix-entities",
+            "collection": "topology-zones-snapshots"
+          }
+        }
+      }
+    ],
     "insightStages": [
       {
         "processorId": "network.cidr-topology-path-resolver",
@@ -350,7 +553,9 @@
     ],
     "associatedContent": {
       "rollParentSnapshots": true,
-      "excludePostfixes": ["raw"]
+      "excludePostfixes": [
+        "raw"
+      ]
     }
   },
   "relations": {}