@x12i/memorix-retrieval 1.31.0 → 1.32.0

package/catalox-seeds/inputs/entity-descriptors/vulnerabilities.json

@@ -35,6 +35,21 @@
         "snapshot.capturedAt",
         "data.enrichment.enrichedAt"
       ]
+    },
+    "discovery": {
+      "postfix": "discovery",
+      "collection": "vulnerabilities-discovery",
+      "dataRoot": "data"
+    },
+    "decisions": {
+      "postfix": "decisions",
+      "collection": "vulnerabilities-decisions",
+      "dataRoot": "data"
+    },
+    "analysis": {
+      "postfix": "analysis",
+      "collection": "vulnerabilities-analysis",
+      "dataRoot": "data"
     }
   },
   "properties": {
@@ -375,11 +390,105 @@
       "list": false,
       "item": true,
       "valueType": "object"
+    },
+    "analysisBriefSummary": {
+      "label": "Brief Summary",
+      "source": { "contentType": "analysis", "path": "data.brief.summary" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisBriefAnalysis": {
+      "label": "Brief Analysis",
+      "source": { "contentType": "analysis", "path": "data.brief.analysis" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisBriefEvidence": {
+      "label": "Brief Evidence",
+      "source": { "contentType": "analysis", "path": "data.brief.evidence" },
+      "humanReadable": true,
+      "list": false,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisBriefGaps": {
+      "label": "Brief Gaps",
+      "source": { "contentType": "analysis", "path": "data.brief.gaps" },
+      "humanReadable": true,
+      "list": false,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisApplicability": {
+      "label": "Applicability",
+      "source": { "contentType": "analysis", "path": "data.applicability" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisExploitability": {
+      "label": "Exploitability",
+      "source": { "contentType": "analysis", "path": "data.exploitability" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisImpact": {
+      "label": "Impact",
+      "source": { "contentType": "analysis", "path": "data.impact" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisThreat": {
+      "label": "Threat",
+      "source": { "contentType": "analysis", "path": "data.threat" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "object"
+    },
+    "analysisMitre": {
+      "label": "MITRE",
+      "source": { "contentType": "analysis", "path": "data.mitre" },
+      "humanReadable": false,
+      "list": false,
+      "item": true,
+      "valueType": "array"
+    },
+    "analysisClassType": {
+      "label": "Analysis Class",
+      "source": { "contentType": "analysis", "path": "data.class.type" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "analysisExploitabilityLevel": {
+      "label": "Exploitability Level (analysis)",
+      "source": { "contentType": "analysis", "path": "data.exploitability.exploitability" },
+      "humanReadable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
     }
   },
+  "importanceIndicator": {
+    "path": "data.severity",
+    "valueKind": "severity",
+    "order": "desc",
+    "description": "Default vulnerability importance: critical > high > medium > low > none"
+  },
   "associatedProperties": [
     {
-      "name": "associatedData",
+      "name": "associatedVulnerabilitiesGroupsSnapshots",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -391,7 +500,19 @@
       "sourceCollection": "vulnerabilities-groups-snapshots"
     },
     {
-      "name": "associatedDiscovery",
+      "name": "associatedVulnerabilitiesGroupsEnrichment",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities-groups",
+      "linkedContentType": "snapshots",
+      "description": "Vulnerability group enrichment payloads (CVSS/EPSS/KEV/compositeScore) copied flat from vulnerabilities-groups-snapshots.enrichment when data.vulnerabilityName matches group data.name. Omitted when enrichment is missing or empty.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerability-groups.enrichment.by-name",
+      "sourceCollection": "vulnerabilities-groups-snapshots"
+    },
+    {
+      "name": "associatedVulnerabilitiesGroupsDiscovery",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -403,7 +524,7 @@
       "sourceCollection": "vulnerabilities-groups-discovery"
     },
     {
-      "name": "associatedAnalysis",
+      "name": "associatedVulnerabilitiesGroupsAnalysis",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -415,7 +536,7 @@
       "sourceCollection": "vulnerabilities-groups-analysis"
     },
     {
-      "name": "associatedAssets",
+      "name": "associatedAssetsSnapshots",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -439,7 +560,7 @@
       "sourceCollection": "subnets-snapshots"
     },
     {
-      "name": "associatedVulnerabilityGroup",
+      "name": "associatedVulnerabilitiesGroupsSnapshots",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -451,7 +572,7 @@
       "sourceCollection": "vulnerabilities-groups-snapshots"
     },
     {
-      "name": "associatedVulnerabilityGroupDiscovery",
+      "name": "associatedVulnerabilitiesGroupsDiscovery",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -463,7 +584,7 @@
       "sourceCollection": "vulnerabilities-groups-discovery"
     },
     {
-      "name": "associatedVulnerabilityGroupAnalysis",
+      "name": "associatedVulnerabilitiesGroupsAnalysis",
       "contentType": "snapshots",
       "kind": "associated",
       "valueShape": "array<object>",
@@ -473,6 +594,30 @@
       "managed": true,
       "refreshRuleKey": "vulnerabilities.vulnerability-groups.analysis.explicit.by-name",
       "sourceCollection": "vulnerabilities-groups-analysis"
+    },
+    {
+      "name": "associatedVulnerabilitiesDiscovery",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities",
+      "linkedContentType": "discovery",
+      "description": "Vulnerability discovery payloads copied from vulnerabilities-discovery.data after matching vulnerabilities-snapshots by data.assetIp and resolving content by snapshot recordId.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerabilities.discovery.by-assetIp",
+      "sourceCollection": "vulnerabilities-discovery"
+    },
+    {
+      "name": "associatedVulnerabilitiesDecisions",
+      "contentType": "snapshots",
+      "kind": "associated",
+      "valueShape": "array<object>",
+      "linkedObjectType": "vulnerabilities",
+      "linkedContentType": "decisions",
+      "description": "Vulnerability decision payloads copied from vulnerabilities-decisions.data after matching vulnerabilities-snapshots by data.assetIp and resolving content by snapshot recordId.",
+      "managed": true,
+      "refreshRuleKey": "vulnerabilities.vulnerabilities.decisions.by-assetIp",
+      "sourceCollection": "vulnerabilities-decisions"
     }
   ],
   "processing": {
@@ -516,17 +661,156 @@
         }
       }
     ],
+    "resolvers": [
+      {
+        "processorId": "vulnerabilities.topology-extractor",
+        "resolverType": "topology-extractor",
+        "kind": "function",
+        "config": {
+          "mode": "subnet-lookup",
+          "assetIpPath": "data.assetIp",
+          "sourcePaths": [
+            "associatedVulnerabilitiesGroupsSnapshots"
+          ],
+          "outputPath": "associatedTopology",
+          "canonicalCollection": {
+            "db": "neo-memorix-entities",
+            "collection": "subnets-snapshots"
+          }
+        }
+      }
+    ],
     "associatedContent": {
       "rollParentSnapshots": true,
-      "excludePostfixes": ["raw"]
+      "excludePostfixes": [
+        "raw"
+      ]
     }
   },
   "narratives": {
     "has-assets": {
       "label": "Has assets",
+      "displayName": "Has assets",
       "kind": "having-signal",
+      "visibility": "user",
       "sourceRef": "affectedAsset",
       "targetEntity": "assets"
+    },
+    "lack-analysis-decision": {
+      "label": "Analysis without decision",
+      "displayName": "Analysis without decision",
+      "description": "Linked vulnerabilities-analysis exists but data.decision is missing or empty.",
+      "kind": "association-common-property",
+      "visibility": "internal",
+      "sourceRef": "vulnerabilities-analysis",
+      "property": "decision"
+    },
+    "has-vulnerability-lack-analysis-decision": {
+      "label": "Has vulnerability lacking analysis decision",
+      "displayName": "Lacking analysis decision",
+      "description": "Alias of lack-analysis-decision for has-* consumers.",
+      "kind": "association-common-property",
+      "visibility": "internal",
+      "sourceRef": "vulnerabilities-analysis",
+      "property": "decision"
+    },
+    "is-vulnerability": {
+      "label": "Is vulnerability",
+      "displayName": "Vulnerability",
+      "description": "Security-impacting scanner result (severity low/medium/high/critical).",
+      "kind": "product-narrative",
+      "visibility": "user"
+    },
+    "is-finding": {
+      "label": "Is finding",
+      "displayName": "Informational finding",
+      "description": "Informational scanner result (severity none/unknown).",
+      "kind": "product-narrative",
+      "visibility": "user"
+    },
+    "has-analysis": {
+      "label": "Has analysis",
+      "displayName": "Has analysis",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-fix-immediately-decision": {
+      "label": "Fix immediately",
+      "displayName": "Fix Immediately",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-remediate-soon-decision": {
+      "label": "Remediate soon",
+      "displayName": "Remediate Soon",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-mitigate-decision": {
+      "label": "Mitigate",
+      "displayName": "Mitigate",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-accept-decision": {
+      "label": "Accept",
+      "displayName": "Accept Risk",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-triage-decision": {
+      "label": "Has triage decision",
+      "displayName": "Triaged",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-breach-vector": {
+      "label": "Breach vector",
+      "displayName": "Breach Vector",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-critical-severity": {
+      "label": "Critical severity",
+      "displayName": "Critical",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-high-severity": {
+      "label": "High severity",
+      "displayName": "High",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-medium-severity": {
+      "label": "Medium severity",
+      "displayName": "Medium",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-low-severity": {
+      "label": "Low severity",
+      "displayName": "Low",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "has-none-severity": {
+      "label": "None severity",
+      "displayName": "None",
+      "kind": "rollup",
+      "visibility": "internal"
+    },
+    "has-tenable-nessus-finding": {
+      "label": "Tenable Nessus finding",
+      "displayName": "Tenable Nessus",
+      "kind": "rollup",
+      "visibility": "user"
+    },
+    "lack-analysis": {
+      "label": "Lack analysis",
+      "displayName": "Missing analysis",
+      "kind": "gap-signal",
+      "visibility": "internal"
     }
   },
   "relations": {
@@ -542,7 +826,7 @@
         "path": "data.assetIps"
       },
       "defaultMode": "array",
-      "defaultArrayProperty": "associatedAssets",
+      "defaultArrayProperty": "associatedAssetsSnapshots",
       "targetFields": [
         "ipAddress",
         "hostName",
@@ -563,7 +847,7 @@
         "path": "data.name"
       },
       "defaultMode": "array",
-      "defaultArrayProperty": "associatedData",
+      "defaultArrayProperty": "associatedVulnerabilitiesGroupsSnapshots",
       "targetFields": [
         "name",
         "severity",

package/catalox-seeds/inputs/item-descriptors/asset-detail-item.json

@@ -18,9 +18,68 @@
           "data.lastSeen"
         ]
       }
+    },
+    {
+      "contentType": "analysis",
+      "required": false,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
+      }
+    },
+    {
+      "contentType": "decisions",
+      "required": false,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
+      }
     }
   ],
   "sections": [
+    {
+      "id": "brief",
+      "title": "Brief",
+      "fields": [
+        "analysisBriefSummary",
+        "analysisBriefTakeaway",
+        "analysisBriefConfidence"
+      ]
+    },
+    {
+      "id": "context",
+      "title": "Context",
+      "fields": ["analysisContext"]
+    },
+    {
+      "id": "reachability",
+      "title": "Reachability",
+      "fields": ["analysisReachability"]
+    },
+    {
+      "id": "paths",
+      "title": "Paths",
+      "fields": ["analysisPaths", "attackPathExistence", "pathsCount"]
+    },
+    {
+      "id": "exploitability",
+      "title": "Exploitability",
+      "fields": ["decisionExploitability"]
+    },
+    {
+      "id": "decision",
+      "title": "Decision",
+      "fields": [
+        "decisionOverviewSummary",
+        "decisionOverviewDetailedAnalysis",
+        "decisionLabel",
+        "decisionStatus",
+        "decisionRiskScore",
+        "decisionUrgencyScore"
+      ]
+    },
     {
       "id": "summary",
       "title": "Summary",
@@ -33,6 +92,7 @@
         "agentType",
         "xdrOperationalStatus",
         "xdrAgentStatus",
+        "observedUsers",
         "lastSeen",
         "pathsCount"
       ]
@@ -44,7 +104,8 @@
         "criticalVulnerabilities",
         "highVulnerabilities",
         "mediumVulnerabilities",
-        "lowVulnerabilities"
+        "lowVulnerabilities",
+        "findingsCount"
       ]
     },
     {
@@ -55,13 +116,6 @@
         "potentialImpactConfidence",
         "potentialImpactStory"
       ]
-    },
-    {
-      "id": "xdr",
-      "title": "XDR",
-      "fields": [
-        "rawXdr"
-      ]
     }
   ],
   "includeRelations": [
@@ -69,12 +123,7 @@
       "relation": "assetSubnet",
       "mode": "record",
       "limit": 1,
-      "fields": [
-        "cidr",
-        "subnetIp",
-        "zone",
-        "vr"
-      ]
+      "fields": ["cidr", "subnetIp", "zone", "vr"]
     },
     {
       "relation": "assetVulnerabilities",

package/catalox-seeds/inputs/item-descriptors/subnet-detail-item.json

@@ -12,10 +12,16 @@
       "multiMatch": {
         "strategy": "last",
         "effectiveDatePath": "capturedAt",
-        "fallbackEffectiveDatePaths": [
-          "modifiedAt",
-          "createdAt"
-        ]
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
+      }
+    },
+    {
+      "contentType": "analysis",
+      "required": false,
+      "multiMatch": {
+        "strategy": "last",
+        "effectiveDatePath": "capturedAt",
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
       }
     },
     {
@@ -24,14 +30,46 @@
       "multiMatch": {
         "strategy": "last",
         "effectiveDatePath": "capturedAt",
-        "fallbackEffectiveDatePaths": [
-          "modifiedAt",
-          "createdAt"
-        ]
+        "fallbackEffectiveDatePaths": ["modifiedAt", "createdAt"]
       }
     }
   ],
   "sections": [
+    {
+      "id": "overview",
+      "title": "Overview",
+      "fields": ["analysisOverview", "analysisOverviewSummary"]
+    },
+    {
+      "id": "role",
+      "title": "Role",
+      "fields": ["analysisRole"]
+    },
+    {
+      "id": "exposure",
+      "title": "Exposure",
+      "fields": ["analysisExposure", "outsideExposureClass"]
+    },
+    {
+      "id": "trust",
+      "title": "Trust",
+      "fields": ["analysisTrust"]
+    },
+    {
+      "id": "attack-path",
+      "title": "Attack Path",
+      "fields": ["analysisAttackPath"]
+    },
+    {
+      "id": "movement",
+      "title": "Movement",
+      "fields": ["analysisMovement"]
+    },
+    {
+      "id": "context",
+      "title": "Context",
+      "fields": ["analysisContext"]
+    },
     {
       "id": "summary",
       "title": "Summary",
@@ -41,6 +79,11 @@
         "zone",
         "zoneClass",
         "vr",
+        "assetsCount",
+        "findingsCount",
+        "vulnerabilitiesCount",
+        "criticalVulnerabilities",
+        "highVulnerabilities",
         "recordId"
       ]
     },
@@ -56,15 +99,6 @@
         "reachableFromZones",
         "zoneMappingConfidence"
       ]
-    },
-    {
-      "id": "legacy",
-      "title": "Legacy (quarantined)",
-      "fields": [
-        "quarantineLegacy",
-        "legacySubnetIp",
-        "quarantineReason"
-      ]
     }
   ],
   "includeRelations": [],