@x12i/memorix-retrieval 1.31.0 → 1.32.0

package/catalox-seeds/memorix-retrieval-descriptors.manifest.json

@@ -288,6 +288,18 @@
             "collection": "assets-scoped",
             "dataRoot": "data",
             "isCanonical": false
+          },
+          "analysis": {
+            "postfix": "analysis",
+            "collection": "assets-analysis",
+            "dataRoot": "data",
+            "isCanonical": false
+          },
+          "decisions": {
+            "postfix": "decision",
+            "collection": "assets-decision",
+            "dataRoot": "data",
+            "isCanonical": false
           }
         },
         "properties": {
@@ -460,6 +472,20 @@
             "item": true,
             "valueType": "number"
           },
+          "findingsCount": {
+            "label": "Findings",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.findings.total"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number",
+            "format": "count"
+          },
           "potentialImpactLevel": {
             "label": "Potential Impact",
             "source": {
@@ -524,11 +550,188 @@
             "list": false,
             "item": true,
             "valueType": "object"
+          },
+          "observedUsers": {
+            "label": "Users",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.observedUsers"
+            },
+            "humanReadable": true,
+            "sortable": false,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "array"
+          },
+          "analysisBriefSummary": {
+            "label": "Brief Summary",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.summary"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefTakeaway": {
+            "label": "Brief Takeaway",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.takeaway"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefConfidence": {
+            "label": "Brief Confidence",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.confidence"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisContext": {
+            "label": "Context",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.context"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisReachability": {
+            "label": "Reachability",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.reachability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisPaths": {
+            "label": "Paths",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.paths"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "attackPathExistence": {
+            "label": "Attack Path Existence",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.paths.attackPathExistence"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "decisionOverviewSummary": {
+            "label": "Decision Summary",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.overview.summary"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "decisionOverviewDetailedAnalysis": {
+            "label": "Decision Detailed Analysis",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.overview.detailedAnalysis"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "decisionExploitability": {
+            "label": "Exploitability Analysis",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.exploitability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "decisionLabel": {
+            "label": "Decision",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.decision.decision"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "decisionStatus": {
+            "label": "Decision Status",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.decision.status"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "decisionRiskScore": {
+            "label": "Decision Score",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.decision.riskScore"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "decisionUrgencyScore": {
+            "label": "Urgency Score",
+            "source": {
+              "contentType": "decisions",
+              "path": "data.decision.urgencyScore"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
           }
         },
         "associatedProperties": [
           {
-            "name": "associatedData",
+            "name": "associatedSubnetsSnapshots",
             "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
@@ -540,7 +743,7 @@
             "sourceCollection": "subnets-snapshots"
           },
           {
-            "name": "associatedDiscovery",
+            "name": "associatedSubnetsDiscovery",
             "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
@@ -552,7 +755,7 @@
             "sourceCollection": "subnets-discovery"
           },
           {
-            "name": "associatedSiblings",
+            "name": "associatedAssetsSnapshots",
             "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
@@ -576,7 +779,7 @@
             "sourceCollection": "subnets-snapshots"
           },
           {
-            "name": "associatedSubnets",
+            "name": "associatedSubnetsSnapshots",
             "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
@@ -610,6 +813,44 @@
             "managed": true,
             "refreshRuleKey": "assets.subnets.analysis.explicit.by-cidr",
             "sourceCollection": "subnets-analysis"
+          },
+          {
+            "name": "associatedTopologyZonesAnalysis",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "topology-zones",
+            "linkedContentType": "analysis",
+            "description": "Zone cyber-analysis payloads joined by host data.zones or associatedTopology.zone to topology-zones-analysis.data.name.",
+            "managed": true,
+            "refreshRuleKey": "assets.topology-zones.analysis.by-zone-name",
+            "sourceCollection": "topology-zones-analysis"
+          },
+          {
+            "name": "associatedVulnerabilitiesAnalysis",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities",
+            "linkedContentType": "analysis",
+            "description": "Vulnerability analysis payloads copied from vulnerabilities-analysis.data after matching vulnerabilities-snapshots by asset IP and resolving content by snapshot recordId.",
+            "managed": true,
+            "refreshRuleKey": "assets.vulnerabilities.analysis.by-assetIp",
+            "sourceCollection": "vulnerabilities-analysis"
+          },
+          {
+            "name": "associatedTopVulnerabilitiesAnalysis",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities",
+            "linkedContentType": "analysis",
+            "description": "Top vulnerability analysis payloads (default 5), ranked by vulnerabilities-snapshots.data.severity after IP match and content resolve by snapshot recordId. Omitted when empty.",
+            "managed": true,
+            "top": true,
+            "maxItems": 5,
+            "refreshRuleKey": "assets.vulnerabilities.analysis.top.by-assetIp",
+            "sourceCollection": "vulnerabilities-analysis"
           }
         ],
         "processing": {
@@ -646,6 +887,18 @@
                   "collection": "subnets-snapshots"
                 }
               }
+            },
+            {
+              "processorId": "assets.topology-extractor",
+              "resolverType": "topology-extractor",
+              "kind": "function",
+              "config": {
+                "mode": "from-associated-data",
+                "sourcePaths": [
+                  "associatedSubnetsSnapshots"
+                ],
+                "outputPath": "associatedTopology"
+              }
             }
           ],
           "associatedContent": {
@@ -658,16 +911,105 @@
         "narratives": {
           "has-vulnerabilities": {
             "label": "Has vulnerabilities",
+            "displayName": "Has vulnerabilities",
             "kind": "having-signal",
+            "visibility": "user",
             "sourceRef": "assetVulnerabilities",
             "targetEntity": "vulnerabilities"
           },
           "has-medium-vulnerabilities": {
+            "label": "Has medium vulnerabilities",
+            "displayName": "Medium vulnerabilities",
             "kind": "association-common-property",
+            "visibility": "user",
             "sourceRef": "assetVulnerabilities",
             "targetEntity": "vulnerabilities",
             "property": "severity",
             "value": "medium"
+          },
+          "is-triaged": {
+            "label": "Is triaged",
+            "displayName": "Triaged",
+            "kind": "product-narrative",
+            "visibility": "user"
+          },
+          "has-triage-decision": {
+            "label": "Has triage decision",
+            "displayName": "Has triage decision",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-no-vulnerabilities": {
+            "label": "No vulnerabilities",
+            "displayName": "No vulnerabilities",
+            "kind": "product-narrative",
+            "visibility": "user"
+          },
+          "has-accept-decision": {
+            "label": "Accept",
+            "displayName": "Accept Risk",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-mitigate-decision": {
+            "label": "Mitigate",
+            "displayName": "Mitigate",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-high-or-critical-exploitability": {
+            "label": "High or critical exploitability",
+            "displayName": "High exploitability",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-lateral-movement-risk": {
+            "label": "Lateral movement risk",
+            "displayName": "Lateral movement risk",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-critical-predicted-impact": {
+            "label": "Critical predicted impact",
+            "displayName": "Critical impact",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-high-predicted-impact": {
+            "label": "High predicted impact",
+            "displayName": "High impact",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-medium-predicted-impact": {
+            "label": "Medium predicted impact",
+            "displayName": "Medium impact",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-low-predicted-impact": {
+            "label": "Low predicted impact",
+            "displayName": "Low impact",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-palo-alto-firewall-source": {
+            "label": "Palo Alto Firewall",
+            "displayName": "Palo Alto Firewall",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-palo-alto-xdr-source": {
+            "label": "Palo Alto XDR",
+            "displayName": "Palo Alto XDR",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-tenable-nessus-source": {
+            "label": "Tenable Nessus",
+            "displayName": "Tenable Nessus",
+            "kind": "rollup",
+            "visibility": "user"
           }
         },
         "relations": {
@@ -682,7 +1024,7 @@
               "path": "data.cidr"
             },
             "defaultMode": "array",
-            "defaultArrayProperty": "associatedData",
+            "defaultArrayProperty": "associatedSubnetsSnapshots",
             "targetFields": [
               "cidr",
               "networkAddress",
@@ -775,6 +1117,12 @@
             "postfix": "legacy",
             "collection": "subnets-legacy",
             "isCanonical": false
+          },
+          "analysis": {
+            "postfix": "analysis",
+            "collection": "subnets-analysis",
+            "dataRoot": "data",
+            "isCanonical": false
           }
         },
         "rootProperties": {
@@ -1011,81 +1359,302 @@
             "item": true,
             "valueType": "string"
           },
-          "quarantineReason": {
-            "label": "Quarantine Reason",
+          "assetsCount": {
+            "label": "Assets #",
             "source": {
-              "contentType": "legacy",
-              "path": "_system.quarantine.reason"
+              "contentType": "snapshots",
+              "path": "analytics.assets.total"
             },
             "humanReadable": true,
-            "sortable": false,
+            "sortable": true,
             "filterable": true,
-            "list": false,
+            "list": true,
             "item": true,
-            "valueType": "string"
-          }
-        },
-        "associatedProperties": [
-          {
-            "name": "associatedChildren",
-            "contentType": "snapshots",
-            "kind": "associated",
-            "valueShape": "array<object>",
-            "linkedObjectType": "assets",
-            "linkedContentType": "snapshots",
-            "description": "Asset snapshot data payloads whose data.subnetCidrs contains this subnet data.cidr. Each item includes linked recordId. Capped at 99 items.",
-            "managed": true,
-            "refreshRuleKey": "subnets.assets.snapshots.by-cidr",
-            "sourceCollection": "assets-snapshots"
-          }
-        ],
-        "processing": {
-          "entityRoutes": [
-            {
-              "routeKey": "zones-to-subnets",
-              "parentObjectType": "topology-zones",
-              "childObjectType": "subnets",
-              "relationshipName": "subnetZone",
-              "direction": "parentToChild",
-              "source": {
-                "contentType": "snapshots",
-                "path": "data.zone"
-              },
-              "target": {
-                "contentType": "snapshots",
-                "path": "data.name"
-              }
-            }
-          ],
-          "insightStages": [
-            {
-              "processorId": "network.cidr-topology-path-resolver",
-              "kind": "function",
-              "inputKind": "cidr",
-              "outputKind": "cidr-path-facts",
-              "writeToInsights": false,
-              "sources": {
-                "topologyDb": "memorix-knowledge",
-                "topologyCollection": "topology-raw"
-              }
+            "valueType": "number",
+            "format": "count"
+          },
+          "findingsCount": {
+            "label": "Findings #",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.findings.total"
             },
-            {
-              "processorId": "network.cidr-zone-path-insights",
-              "kind": "function",
-              "inputKind": "cidr-path-facts",
-              "outputKind": "insights",
-              "writeToInsights": true,
-              "sources": {
-                "zonesCollection": "topology-zones-snapshots"
-              }
-            }
-          ],
-          "associatedContent": {
-            "rollParentSnapshots": true,
-            "excludePostfixes": [
-              "raw"
-            ]
-          }
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number",
+            "format": "count"
+          },
+          "vulnerabilitiesCount": {
+            "label": "Vulnerabilities #",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.total"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number",
+            "format": "count"
+          },
+          "criticalVulnerabilities": {
+            "label": "Critical Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.critical"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "highVulnerabilities": {
+            "label": "High Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.high"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "mediumVulnerabilities": {
+            "label": "Medium Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.medium"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "lowVulnerabilities": {
+            "label": "Low Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.low"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "quarantineReason": {
+            "label": "Quarantine Reason",
+            "source": {
+              "contentType": "legacy",
+              "path": "_system.quarantine.reason"
+            },
+            "humanReadable": true,
+            "sortable": false,
+            "filterable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisOverview": {
+            "label": "Overview",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.overview"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisOverviewSummary": {
+            "label": "Overview Summary",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.overview.summary"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisRole": {
+            "label": "Role",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.cyberRoleInterpretation"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisExposure": {
+            "label": "Exposure",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.externalAndLowerTrustReachability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisTrust": {
+            "label": "Trust",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.trustPositionInterpretation"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisAttackPath": {
+            "label": "Attack Path",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.possibleAttackPathAnalysis"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisMovement": {
+            "label": "Movement",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.outboundAndBlastPathInterpretation"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisContext": {
+            "label": "Context",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.aggregateContextInterpretation"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          }
+        },
+        "associatedProperties": [
+          {
+            "name": "associatedAssetsSnapshots",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "assets",
+            "linkedContentType": "snapshots",
+            "description": "Asset snapshot data payloads whose data.subnetCidrs contains this subnet data.cidr. Each item includes linked recordId. Capped at 99 items.",
+            "managed": true,
+            "refreshRuleKey": "subnets.assets.snapshots.by-cidr",
+            "sourceCollection": "assets-snapshots"
+          },
+          {
+            "name": "associatedTopologyZonesAnalysis",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "topology-zones",
+            "linkedContentType": "analysis",
+            "description": "Zone cyber-analysis joined from subnet data.zone to topology-zones-analysis.data.name.",
+            "managed": true,
+            "refreshRuleKey": "subnets.topology-zones.analysis.by-zone-name",
+            "sourceCollection": "topology-zones-analysis"
+          }
+        ],
+        "processing": {
+          "entityRoutes": [
+            {
+              "routeKey": "zones-to-subnets",
+              "parentObjectType": "topology-zones",
+              "childObjectType": "subnets",
+              "relationshipName": "subnetZone",
+              "direction": "parentToChild",
+              "source": {
+                "contentType": "snapshots",
+                "path": "data.zone"
+              },
+              "target": {
+                "contentType": "snapshots",
+                "path": "data.name"
+              }
+            }
+          ],
+          "resolvers": [
+            {
+              "processorId": "subnets.subnet-key",
+              "resolverType": "subnet-key",
+              "kind": "function",
+              "config": {
+                "mode": "from-cidr",
+                "sourcePath": "data.cidr"
+              }
+            },
+            {
+              "processorId": "subnets.zone-from-topology",
+              "resolverType": "zone-from-topology",
+              "kind": "function",
+              "config": {
+                "onlyWhenZoneIs": "UNKNOWN",
+                "topologyRaw": {
+                  "db": "memorix-knowledge",
+                  "collection": "topology-raw"
+                },
+                "zonesRegistry": {
+                  "db": "neo-memorix-entities",
+                  "collection": "topology-zones-snapshots"
+                }
+              }
+            }
+          ],
+          "insightStages": [
+            {
+              "processorId": "network.cidr-topology-path-resolver",
+              "kind": "function",
+              "inputKind": "cidr",
+              "outputKind": "cidr-path-facts",
+              "writeToInsights": false,
+              "sources": {
+                "topologyDb": "memorix-knowledge",
+                "topologyCollection": "topology-raw"
+              }
+            },
+            {
+              "processorId": "network.cidr-zone-path-insights",
+              "kind": "function",
+              "inputKind": "cidr-path-facts",
+              "outputKind": "insights",
+              "writeToInsights": true,
+              "sources": {
+                "zonesCollection": "topology-zones-snapshots"
+              }
+            }
+          ],
+          "associatedContent": {
+            "rollParentSnapshots": true,
+            "excludePostfixes": [
+              "raw"
+            ]
+          }
         },
         "relations": {},
         "schemaVersion": "memorix.objectTypeDescriptor.v2",
@@ -1139,6 +1708,21 @@
               "snapshot.capturedAt",
               "data.enrichment.enrichedAt"
             ]
+          },
+          "discovery": {
+            "postfix": "discovery",
+            "collection": "vulnerabilities-discovery",
+            "dataRoot": "data"
+          },
+          "decisions": {
+            "postfix": "decisions",
+            "collection": "vulnerabilities-decisions",
+            "dataRoot": "data"
+          },
+          "analysis": {
+            "postfix": "analysis",
+            "collection": "vulnerabilities-analysis",
+            "dataRoot": "data"
           }
         },
         "properties": {
@@ -1479,36 +2063,175 @@
             "list": false,
             "item": true,
             "valueType": "object"
-          }
-        },
-        "associatedProperties": [
-          {
-            "name": "associatedData",
-            "contentType": "snapshots",
-            "kind": "associated",
-            "valueShape": "array<object>",
-            "linkedObjectType": "vulnerabilities-groups",
-            "linkedContentType": "snapshots",
-            "description": "Vulnerability group snapshot payloads copied from vulnerabilities-groups-snapshots.data when data.vulnerabilityName matches group data.name.",
-            "managed": true,
-            "refreshRuleKey": "vulnerabilities.vulnerability-groups.snapshots.by-name",
-            "sourceCollection": "vulnerabilities-groups-snapshots"
           },
-          {
-            "name": "associatedDiscovery",
-            "contentType": "snapshots",
-            "kind": "associated",
-            "valueShape": "array<object>",
-            "linkedObjectType": "vulnerabilities-groups",
-            "linkedContentType": "discovery",
-            "description": "Vulnerability group discovery payloads copied from vulnerabilities-groups-discovery.data via group name bridge.",
-            "managed": true,
-            "refreshRuleKey": "vulnerabilities.vulnerability-groups.discovery.by-name",
-            "sourceCollection": "vulnerabilities-groups-discovery"
+          "analysisBriefSummary": {
+            "label": "Brief Summary",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.summary"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
           },
-          {
-            "name": "associatedAnalysis",
-            "contentType": "snapshots",
+          "analysisBriefAnalysis": {
+            "label": "Brief Analysis",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.analysis"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefEvidence": {
+            "label": "Brief Evidence",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.evidence"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefGaps": {
+            "label": "Brief Gaps",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.gaps"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisApplicability": {
+            "label": "Applicability",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.applicability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisExploitability": {
+            "label": "Exploitability",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.exploitability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisImpact": {
+            "label": "Impact",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.impact"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisThreat": {
+            "label": "Threat",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.threat"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisMitre": {
+            "label": "MITRE",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.mitre"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "array"
+          },
+          "analysisClassType": {
+            "label": "Analysis Class",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.class.type"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisExploitabilityLevel": {
+            "label": "Exploitability Level (analysis)",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.exploitability.exploitability"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          }
+        },
+        "importanceIndicator": {
+          "path": "data.severity",
+          "valueKind": "severity",
+          "order": "desc",
+          "description": "Default vulnerability importance: critical > high > medium > low > none"
+        },
+        "associatedProperties": [
+          {
+            "name": "associatedVulnerabilitiesGroupsSnapshots",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities-groups",
+            "linkedContentType": "snapshots",
+            "description": "Vulnerability group snapshot payloads copied from vulnerabilities-groups-snapshots.data when data.vulnerabilityName matches group data.name.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerability-groups.snapshots.by-name",
+            "sourceCollection": "vulnerabilities-groups-snapshots"
+          },
+          {
+            "name": "associatedVulnerabilitiesGroupsEnrichment",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities-groups",
+            "linkedContentType": "snapshots",
+            "description": "Vulnerability group enrichment payloads (CVSS/EPSS/KEV/compositeScore) copied flat from vulnerabilities-groups-snapshots.enrichment when data.vulnerabilityName matches group data.name. Omitted when enrichment is missing or empty.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerability-groups.enrichment.by-name",
+            "sourceCollection": "vulnerabilities-groups-snapshots"
+          },
+          {
+            "name": "associatedVulnerabilitiesGroupsDiscovery",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities-groups",
+            "linkedContentType": "discovery",
+            "description": "Vulnerability group discovery payloads copied from vulnerabilities-groups-discovery.data via group name bridge.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerability-groups.discovery.by-name",
+            "sourceCollection": "vulnerabilities-groups-discovery"
+          },
+          {
+            "name": "associatedVulnerabilitiesGroupsAnalysis",
+            "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
             "linkedObjectType": "vulnerabilities-groups",
@@ -1519,7 +2242,7 @@
             "sourceCollection": "vulnerabilities-groups-analysis"
           },
           {
-            "name": "associatedAssets",
+            "name": "associatedAssetsSnapshots",
             "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
@@ -1543,7 +2266,7 @@
             "sourceCollection": "subnets-snapshots"
           },
           {
-            "name": "associatedVulnerabilityGroup",
+            "name": "associatedVulnerabilitiesGroupsSnapshots",
             "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
@@ -1555,7 +2278,7 @@
             "sourceCollection": "vulnerabilities-groups-snapshots"
           },
           {
-            "name": "associatedVulnerabilityGroupDiscovery",
+            "name": "associatedVulnerabilitiesGroupsDiscovery",
             "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
@@ -1567,7 +2290,7 @@
             "sourceCollection": "vulnerabilities-groups-discovery"
           },
           {
-            "name": "associatedVulnerabilityGroupAnalysis",
+            "name": "associatedVulnerabilitiesGroupsAnalysis",
             "contentType": "snapshots",
             "kind": "associated",
             "valueShape": "array<object>",
@@ -1577,6 +2300,30 @@
             "managed": true,
             "refreshRuleKey": "vulnerabilities.vulnerability-groups.analysis.explicit.by-name",
             "sourceCollection": "vulnerabilities-groups-analysis"
+          },
+          {
+            "name": "associatedVulnerabilitiesDiscovery",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities",
+            "linkedContentType": "discovery",
+            "description": "Vulnerability discovery payloads copied from vulnerabilities-discovery.data after matching vulnerabilities-snapshots by data.assetIp and resolving content by snapshot recordId.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerabilities.discovery.by-assetIp",
+            "sourceCollection": "vulnerabilities-discovery"
+          },
+          {
+            "name": "associatedVulnerabilitiesDecisions",
+            "contentType": "snapshots",
+            "kind": "associated",
+            "valueShape": "array<object>",
+            "linkedObjectType": "vulnerabilities",
+            "linkedContentType": "decisions",
+            "description": "Vulnerability decision payloads copied from vulnerabilities-decisions.data after matching vulnerabilities-snapshots by data.assetIp and resolving content by snapshot recordId.",
+            "managed": true,
+            "refreshRuleKey": "vulnerabilities.vulnerabilities.decisions.by-assetIp",
+            "sourceCollection": "vulnerabilities-decisions"
           }
         ],
         "processing": {
@@ -1620,6 +2367,25 @@
               }
             }
           ],
+          "resolvers": [
+            {
+              "processorId": "vulnerabilities.topology-extractor",
+              "resolverType": "topology-extractor",
+              "kind": "function",
+              "config": {
+                "mode": "subnet-lookup",
+                "assetIpPath": "data.assetIp",
+                "sourcePaths": [
+                  "associatedVulnerabilitiesGroupsSnapshots"
+                ],
+                "outputPath": "associatedTopology",
+                "canonicalCollection": {
+                  "db": "neo-memorix-entities",
+                  "collection": "subnets-snapshots"
+                }
+              }
+            }
+          ],
           "associatedContent": {
             "rollParentSnapshots": true,
             "excludePostfixes": [
@@ -1630,9 +2396,127 @@
         "narratives": {
           "has-assets": {
             "label": "Has assets",
+            "displayName": "Has assets",
             "kind": "having-signal",
+            "visibility": "user",
             "sourceRef": "affectedAsset",
             "targetEntity": "assets"
+          },
+          "lack-analysis-decision": {
+            "label": "Analysis without decision",
+            "displayName": "Analysis without decision",
+            "description": "Linked vulnerabilities-analysis exists but data.decision is missing or empty.",
+            "kind": "association-common-property",
+            "visibility": "internal",
+            "sourceRef": "vulnerabilities-analysis",
+            "property": "decision"
+          },
+          "has-vulnerability-lack-analysis-decision": {
+            "label": "Has vulnerability lacking analysis decision",
+            "displayName": "Lacking analysis decision",
+            "description": "Alias of lack-analysis-decision for has-* consumers.",
+            "kind": "association-common-property",
+            "visibility": "internal",
+            "sourceRef": "vulnerabilities-analysis",
+            "property": "decision"
+          },
+          "is-vulnerability": {
+            "label": "Is vulnerability",
+            "displayName": "Vulnerability",
+            "description": "Security-impacting scanner result (severity low/medium/high/critical).",
+            "kind": "product-narrative",
+            "visibility": "user"
+          },
+          "is-finding": {
+            "label": "Is finding",
+            "displayName": "Informational finding",
+            "description": "Informational scanner result (severity none/unknown).",
+            "kind": "product-narrative",
+            "visibility": "user"
+          },
+          "has-analysis": {
+            "label": "Has analysis",
+            "displayName": "Has analysis",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-fix-immediately-decision": {
+            "label": "Fix immediately",
+            "displayName": "Fix Immediately",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-remediate-soon-decision": {
+            "label": "Remediate soon",
+            "displayName": "Remediate Soon",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-mitigate-decision": {
+            "label": "Mitigate",
+            "displayName": "Mitigate",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-accept-decision": {
+            "label": "Accept",
+            "displayName": "Accept Risk",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-triage-decision": {
+            "label": "Has triage decision",
+            "displayName": "Triaged",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-breach-vector": {
+            "label": "Breach vector",
+            "displayName": "Breach Vector",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-critical-severity": {
+            "label": "Critical severity",
+            "displayName": "Critical",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-high-severity": {
+            "label": "High severity",
+            "displayName": "High",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-medium-severity": {
+            "label": "Medium severity",
+            "displayName": "Medium",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-low-severity": {
+            "label": "Low severity",
+            "displayName": "Low",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "has-none-severity": {
+            "label": "None severity",
+            "displayName": "None",
+            "kind": "rollup",
+            "visibility": "internal"
+          },
+          "has-tenable-nessus-finding": {
+            "label": "Tenable Nessus finding",
+            "displayName": "Tenable Nessus",
+            "kind": "rollup",
+            "visibility": "user"
+          },
+          "lack-analysis": {
+            "label": "Lack analysis",
+            "displayName": "Missing analysis",
+            "kind": "gap-signal",
+            "visibility": "internal"
           }
         },
         "relations": {
@@ -1647,7 +2531,7 @@
               "path": "data.assetIps"
             },
             "defaultMode": "array",
-            "defaultArrayProperty": "associatedAssets",
+            "defaultArrayProperty": "associatedAssetsSnapshots",
             "targetFields": [
               "ipAddress",
               "hostName",
@@ -1668,7 +2552,7 @@
               "path": "data.name"
             },
             "defaultMode": "array",
-            "defaultArrayProperty": "associatedData",
+            "defaultArrayProperty": "associatedVulnerabilitiesGroupsSnapshots",
             "targetFields": [
               "name",
               "severity",
@@ -1803,112 +2687,324 @@
             "list": true,
             "item": true,
             "valueType": "number"
-          }
-        },
-        "associatedProperties": [],
-        "processing": {
-          "associatedContent": {
-            "rollParentSnapshots": false,
-            "excludePostfixes": [
-              "raw"
-            ]
-          }
-        },
-        "relations": {
-          "groupVulnerabilities": {
-            "type": "oneToMany",
+          },
+          "affectedEntitiesCount": {
+            "label": "Affected #",
             "source": {
               "contentType": "snapshots",
-              "path": "data.name"
+              "path": "analytics.affectedAssets.total"
             },
-            "target": {
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "number",
+            "format": "count"
+          },
+          "findingsCount": {
+            "label": "Findings #",
+            "source": {
               "contentType": "snapshots",
-              "path": "data.vulnerabilityName"
+              "path": "analytics.findings.total"
             },
-            "defaultMode": "array",
-            "defaultArrayProperty": "vulnerabilities",
-            "targetFields": [
-              "assetIp",
-              "severity",
-              "cveId",
-              "pluginName"
-            ],
-            "targetObjectType": "vulnerabilities"
-          }
-        },
-        "schemaVersion": "memorix.objectTypeDescriptor.v2",
-        "objectType": "vulnerabilities-groups"
-      }
-    },
-    {
-      "catalogId": "memorix-object-type-descriptors",
-      "scope": {
-        "domains": [
-          "network",
-          "vulnerabilities"
-        ],
-        "agents": [
-          "neo"
-        ]
-      },
-      "data": {
-        "id": "knowledge-playbooks",
-        "defaultListDescriptorId": "knowledge-playbooks-main-list",
-        "defaultItemDescriptorId": "knowledge-playbook-detail-item",
-        "target": "knowledge",
-        "collectionPrefix": "knowledge-playbooks",
-        "identity": {
-          "allowedIdFields": [
-            "knowledgeId"
-          ],
-          "requiredExactlyOne": true,
-          "defaultIdField": "knowledgeId"
-        },
-        "defaults": {
-          "canonicalContentType": "snapshots",
-          "dataRoot": "data",
-          "effectiveDatePath": "capturedAt"
-        },
-        "contentTypes": {
-          "snapshots": {
-            "postfix": "snapshots",
-            "collection": "knowledge-playbooks-snapshots",
-            "dataRoot": "data",
-            "isCanonical": true,
-            "effectiveDatePath": "capturedAt"
-          }
-        },
-        "properties": {
-          "title": {
-            "label": "Title",
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "number",
+            "format": "count"
+          },
+          "vulnerabilitiesCount": {
+            "label": "Vulnerabilities #",
             "source": {
               "contentType": "snapshots",
-              "path": "data.title"
+              "path": "analytics.vulnerabilities.total"
             },
             "humanReadable": true,
             "sortable": true,
-            "filterable": true,
+            "filterable": false,
             "list": true,
             "item": true,
-            "valueType": "string"
+            "valueType": "number",
+            "format": "count"
           },
-          "summary": {
-            "label": "Summary",
+          "criticalVulnerabilities": {
+            "label": "Critical Vulnerabilities",
             "source": {
               "contentType": "snapshots",
-              "path": "data.summary"
+              "path": "analytics.vulnerabilities.critical"
             },
             "humanReadable": true,
-            "sortable": false,
+            "sortable": true,
             "filterable": false,
             "list": true,
             "item": true,
-            "valueType": "string"
-          }
-        },
-        "schemaVersion": "memorix.objectTypeDescriptor.v2",
-        "objectType": "knowledge-playbooks"
-      }
+            "valueType": "number"
+          },
+          "highVulnerabilities": {
+            "label": "High Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.high"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "mediumVulnerabilities": {
+            "label": "Medium Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.medium"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "lowVulnerabilities": {
+            "label": "Low Vulnerabilities",
+            "source": {
+              "contentType": "snapshots",
+              "path": "analytics.vulnerabilities.low"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "riskLevel": {
+            "label": "Risk Level",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.enrichment.riskLevel"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "priorityScore": {
+            "label": "Priority Score",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.enrichment.priorityScore"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "number"
+          },
+          "knownExploited": {
+            "label": "Known Exploited (KEV)",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.enrichment.knownExploited"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "vulnerabilityType": {
+            "label": "Type",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.vulnerability_type"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefSummary": {
+            "label": "Brief Summary",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.summary"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefAnalysis": {
+            "label": "Brief Analysis",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.analysis"
+            },
+            "humanReadable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefEvidence": {
+            "label": "Brief Evidence",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.evidence"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisBriefGaps": {
+            "label": "Brief Gaps",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.brief.gaps"
+            },
+            "humanReadable": true,
+            "list": false,
+            "item": true,
+            "valueType": "string"
+          },
+          "analysisApplicability": {
+            "label": "Applicability",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.applicability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisExploitability": {
+            "label": "Exploitability",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.exploitability"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisImpact": {
+            "label": "Impact",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.impact"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisThreat": {
+            "label": "Threat",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.threat"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "object"
+          },
+          "analysisMitre": {
+            "label": "MITRE",
+            "source": {
+              "contentType": "analysis",
+              "path": "data.mitre"
+            },
+            "humanReadable": false,
+            "list": false,
+            "item": true,
+            "valueType": "array"
+          }
+        },
+        "associatedProperties": [],
+        "narratives": {
+          "has-none-severity": {
+            "label": "None severity",
+            "kind": "association-common-property",
+            "sourceRef": "severity",
+            "property": "severity",
+            "value": "none"
+          },
+          "has-low-severity": {
+            "label": "Low severity",
+            "kind": "association-common-property",
+            "sourceRef": "severity",
+            "property": "severity",
+            "value": "low"
+          },
+          "has-medium-severity": {
+            "label": "Medium severity",
+            "kind": "association-common-property",
+            "sourceRef": "severity",
+            "property": "severity",
+            "value": "medium"
+          },
+          "has-high-severity": {
+            "label": "High severity",
+            "kind": "association-common-property",
+            "sourceRef": "severity",
+            "property": "severity",
+            "value": "high"
+          },
+          "has-critical-severity": {
+            "label": "Critical severity",
+            "kind": "association-common-property",
+            "sourceRef": "severity",
+            "property": "severity",
+            "value": "critical"
+          }
+        },
+        "processing": {
+          "associatedContent": {
+            "rollParentSnapshots": false,
+            "excludePostfixes": [
+              "raw"
+            ]
+          }
+        },
+        "relations": {
+          "groupVulnerabilities": {
+            "type": "oneToMany",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.name"
+            },
+            "target": {
+              "contentType": "snapshots",
+              "path": "data.vulnerabilityName"
+            },
+            "defaultMode": "array",
+            "defaultArrayProperty": "vulnerabilities",
+            "targetFields": [
+              "assetIp",
+              "severity",
+              "cveId",
+              "pluginName"
+            ],
+            "targetObjectType": "vulnerabilities"
+          }
+        },
+        "schemaVersion": "memorix.objectTypeDescriptor.v2",
+        "objectType": "vulnerabilities-groups"
+      }
     },
     {
       "catalogId": "memorix-object-type-descriptors",
@@ -1922,11 +3018,11 @@
         ]
       },
       "data": {
-        "id": "content-documents",
-        "defaultListDescriptorId": "content-documents-main-list",
-        "defaultItemDescriptorId": "content-document-detail-item",
+        "id": "knowledge-playbooks",
+        "defaultListDescriptorId": "knowledge-playbooks-main-list",
+        "defaultItemDescriptorId": "knowledge-playbook-detail-item",
         "target": "knowledge",
-        "collectionPrefix": "content-documents",
+        "collectionPrefix": "knowledge-playbooks",
         "identity": {
           "allowedIdFields": [
             "knowledgeId"
@@ -1942,24 +3038,9 @@
         "contentTypes": {
           "snapshots": {
             "postfix": "snapshots",
-            "collection": "content-documents-snapshots",
+            "collection": "knowledge-playbooks-snapshots",
             "dataRoot": "data",
             "isCanonical": true,
-            "cardinality": "1:1",
-            "effectiveDatePath": "capturedAt"
-          },
-          "extractions": {
-            "postfix": "extractions",
-            "collection": "content-documents-extractions",
-            "dataRoot": "data",
-            "cardinality": "1:n",
-            "effectiveDatePath": "capturedAt"
-          },
-          "chunks": {
-            "postfix": "chunks",
-            "collection": "content-documents-chunks",
-            "dataRoot": "data",
-            "cardinality": "1:n",
             "effectiveDatePath": "capturedAt"
           }
         },
@@ -1989,33 +3070,118 @@
             "list": true,
             "item": true,
             "valueType": "string"
+          }
+        },
+        "schemaVersion": "memorix.objectTypeDescriptor.v2",
+        "objectType": "knowledge-playbooks"
+      }
+    },
+    {
+      "catalogId": "memorix-object-type-descriptors",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "content-documents",
+        "defaultListDescriptorId": "content-documents-main-list",
+        "defaultItemDescriptorId": "content-document-detail-item",
+        "target": "knowledge",
+        "collectionPrefix": "content-documents",
+        "identity": {
+          "allowedIdFields": [
+            "knowledgeId"
+          ],
+          "requiredExactlyOne": true,
+          "defaultIdField": "knowledgeId"
+        },
+        "defaults": {
+          "canonicalContentType": "snapshots",
+          "dataRoot": "data",
+          "effectiveDatePath": "capturedAt"
+        },
+        "contentTypes": {
+          "snapshots": {
+            "postfix": "snapshots",
+            "collection": "content-documents-snapshots",
+            "dataRoot": "data",
+            "isCanonical": true,
+            "cardinality": "1:1",
+            "effectiveDatePath": "capturedAt"
+          },
+          "extractions": {
+            "postfix": "extractions",
+            "collection": "content-documents-extractions",
+            "dataRoot": "data",
+            "cardinality": "1:n",
+            "effectiveDatePath": "capturedAt"
+          },
+          "chunks": {
+            "postfix": "chunks",
+            "collection": "content-documents-chunks",
+            "dataRoot": "data",
+            "cardinality": "1:n",
+            "effectiveDatePath": "capturedAt"
+          }
+        },
+        "properties": {
+          "title": {
+            "label": "Title",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.title"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "summary": {
+            "label": "Summary",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.summary"
+            },
+            "humanReadable": true,
+            "sortable": false,
+            "filterable": false,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "language": {
+            "label": "Language",
+            "source": {
+              "contentType": "snapshots",
+              "path": "data.language"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
+          },
+          "sourceKind": {
+            "label": "Source kind",
+            "source": {
+              "contentType": "snapshots",
+              "path": "source.kind"
+            },
+            "humanReadable": true,
+            "sortable": true,
+            "filterable": true,
+            "list": true,
+            "item": true,
+            "valueType": "string"
           },
-          "language": {
-            "label": "Language",
-            "source": {
-              "contentType": "snapshots",
-              "path": "data.language"
-            },
-            "humanReadable": true,
-            "sortable": true,
-            "filterable": true,
-            "list": true,
-            "item": true,
-            "valueType": "string"
-          },
-          "sourceKind": {
-            "label": "Source kind",
-            "source": {
-              "contentType": "snapshots",
-              "path": "source.kind"
-            },
-            "humanReadable": true,
-            "sortable": true,
-            "filterable": true,
-            "list": true,
-            "item": true,
-            "valueType": "string"
-          },
           "sourceUri": {
             "label": "Source URI",
             "source": {
@@ -2043,8 +3209,555 @@
             "valueType": "string"
           }
         },
-        "schemaVersion": "memorix.objectTypeDescriptor.v2",
-        "objectType": "content-documents"
+        "schemaVersion": "memorix.objectTypeDescriptor.v2",
+        "objectType": "content-documents"
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "assets-main-list",
+        "entity": "assets",
+        "title": "Assets",
+        "leadingContentType": "snapshots",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [],
+        "fields": [
+          "ipAddress",
+          "subnetIp",
+          "subnetCidr",
+          "hostName",
+          "source",
+          "agentType",
+          "xdrOperationalStatus",
+          "xdrAgentStatus",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "findingsCount",
+          "potentialImpactLevel",
+          "pathsCount",
+          "observedUsers",
+          "lastSeen"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "ipAddress",
+          "subnetIp",
+          "subnetCidr",
+          "hostName",
+          "source",
+          "agentType",
+          "xdrOperationalStatus",
+          "xdrAgentStatus",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "findingsCount",
+          "potentialImpactLevel",
+          "pathsCount",
+          "lastSeen"
+        ],
+        "defaultSort": {
+          "property": "ipAddress",
+          "direction": "asc"
+        },
+        "allowSortDrivenLeadingOverride": false,
+        "columnDrillDowns": [
+          {
+            "field": "criticalVulnerabilities",
+            "label": "Critical Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-critical-severity"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "highVulnerabilities",
+            "label": "High Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-high-severity"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "findingsCount",
+            "label": "Findings",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-observations-list",
+              "narrativeIds": [
+                "is-finding"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          }
+        ]
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "vulnerable-assets-list",
+        "entity": "assets",
+        "title": "Vulnerable Assets",
+        "leadingContentType": "snapshots",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [
+          {
+            "property": "narrativeId",
+            "operator": "ne",
+            "value": "has-no-vulnerabilities"
+          }
+        ],
+        "fields": [
+          "ipAddress",
+          "hostName",
+          "source",
+          "pathsCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "findingsCount",
+          "agentType",
+          "xdrAgentStatus",
+          "xdrOperationalStatus",
+          "observedUsers",
+          "lastSeen"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "ipAddress",
+          "hostName",
+          "source",
+          "pathsCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "findingsCount",
+          "agentType",
+          "xdrAgentStatus",
+          "xdrOperationalStatus",
+          "lastSeen"
+        ],
+        "defaultSort": {
+          "property": "ipAddress",
+          "direction": "asc"
+        },
+        "allowSortDrivenLeadingOverride": false,
+        "columnDrillDowns": [
+          {
+            "field": "criticalVulnerabilities",
+            "label": "Critical Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-critical-severity"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "highVulnerabilities",
+            "label": "High Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-high-severity"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "findingsCount",
+            "label": "Findings",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-observations-list",
+              "narrativeIds": [
+                "is-finding"
+              ],
+              "filters": [
+                {
+                  "property": "assetIp",
+                  "operator": "eq",
+                  "valueFromRow": "ipAddress"
+                }
+              ]
+            }
+          }
+        ]
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "assets-exploitability-decisions-list",
+        "entity": "assets",
+        "title": "Assets Exploitability",
+        "leadingContentType": "decisions",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [],
+        "fields": [
+          "decisionOverviewSummary",
+          "decisionOverviewDetailedAnalysis",
+          "decisionLabel",
+          "decisionStatus",
+          "decisionRiskScore",
+          "decisionUrgencyScore"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "decisionRiskScore",
+          "decisionUrgencyScore",
+          "decisionStatus",
+          "decisionLabel"
+        ],
+        "defaultSort": {
+          "property": "decisionRiskScore",
+          "direction": "desc"
+        },
+        "allowSortDrivenLeadingOverride": false
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "assets-potential-impact-decisions-list",
+        "entity": "assets",
+        "title": "Asset's Potential Impact",
+        "leadingContentType": "decisions",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [],
+        "fields": [
+          "decisionOverviewSummary",
+          "decisionOverviewDetailedAnalysis",
+          "decisionLabel",
+          "decisionStatus",
+          "decisionRiskScore"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "decisionRiskScore",
+          "decisionStatus",
+          "decisionLabel"
+        ],
+        "defaultSort": {
+          "property": "decisionRiskScore",
+          "direction": "desc"
+        },
+        "allowSortDrivenLeadingOverride": false
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "subnets-main-list",
+        "entity": "subnets",
+        "title": "Networks",
+        "leadingContentType": "snapshots",
+        "fields": [
+          "subnetIp",
+          "cidr",
+          "zone",
+          "zoneClass",
+          "vr",
+          "networkAddress",
+          "assetsCount",
+          "findingsCount",
+          "vulnerabilitiesCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "outsideExposureClass",
+          "internalReachabilityClass",
+          "recordId"
+        ],
+        "defaultSort": {
+          "property": "cidr",
+          "direction": "asc"
+        },
+        "allowedSorts": [
+          "subnetIp",
+          "cidr",
+          "zone",
+          "zoneClass",
+          "vr",
+          "assetsCount",
+          "findingsCount",
+          "vulnerabilitiesCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
+          "outsideExposureClass",
+          "internalReachabilityClass"
+        ],
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "columnDrillDowns": [
+          {
+            "field": "assetsCount",
+            "label": "Assets #",
+            "listQuery": {
+              "entityName": "assets",
+              "listDescriptorId": "assets-main-list",
+              "filters": [
+                {
+                  "property": "subnetCidrs",
+                  "operator": "eq",
+                  "valueFromRow": "cidr"
+                }
+              ]
+            }
+          },
+          {
+            "field": "findingsCount",
+            "label": "Findings #",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-observations-list",
+              "narrativeIds": [
+                "is-finding"
+              ],
+              "filters": [
+                {
+                  "property": "subnetIp",
+                  "operator": "eq",
+                  "valueFromRow": "networkAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "vulnerabilitiesCount",
+            "label": "Vulnerabilities #",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability"
+              ],
+              "filters": [
+                {
+                  "property": "subnetIp",
+                  "operator": "eq",
+                  "valueFromRow": "networkAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "criticalVulnerabilities",
+            "label": "Critical Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-critical-severity"
+              ],
+              "filters": [
+                {
+                  "property": "subnetIp",
+                  "operator": "eq",
+                  "valueFromRow": "networkAddress"
+                }
+              ]
+            }
+          },
+          {
+            "field": "highVulnerabilities",
+            "label": "High Vulnerabilities",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability",
+                "has-high-severity"
+              ],
+              "filters": [
+                {
+                  "property": "subnetIp",
+                  "operator": "eq",
+                  "valueFromRow": "networkAddress"
+                }
+              ]
+            }
+          }
+        ]
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "vulnerabilities-main-list",
+        "entity": "vulnerabilities",
+        "title": "Vulnerabilities",
+        "leadingContentType": "snapshots",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [
+          {
+            "property": "narrativeId",
+            "operator": "eq",
+            "value": "is-vulnerability"
+          }
+        ],
+        "fields": [
+          "vulnerabilityId",
+          "assetIp",
+          "subnetIp",
+          "pluginName",
+          "pluginFamily",
+          "severity",
+          "cveId",
+          "riskLevel",
+          "priorityScore",
+          "epss",
+          "knownExploited",
+          "exploitabilityLevel",
+          "networkExposure"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "vulnerabilityId",
+          "assetIp",
+          "subnetIp",
+          "pluginName",
+          "pluginFamily",
+          "severity",
+          "riskLevel",
+          "priorityScore",
+          "epss",
+          "knownExploited",
+          "exploitabilityScore",
+          "exploitabilityLevel",
+          "networkExposure"
+        ],
+        "defaultSort": {
+          "property": "priorityScore",
+          "direction": "desc"
+        },
+        "allowSortDrivenLeadingOverride": false
       }
     },
     {
@@ -2059,49 +3772,44 @@
         ]
       },
       "data": {
-        "id": "assets-main-list",
-        "entity": "assets",
-        "title": "Assets",
+        "id": "vulnerabilities-observations-list",
+        "entity": "vulnerabilities",
+        "title": "Observations",
         "leadingContentType": "snapshots",
         "pagination": {
           "enabled": true,
           "defaultLimit": 50,
           "maxLimit": 200
         },
-        "filters": [],
+        "filters": [
+          {
+            "property": "narrativeId",
+            "operator": "eq",
+            "value": "is-finding"
+          }
+        ],
         "fields": [
-          "ipAddress",
-          "subnetIp",
-          "subnetCidr",
-          "hostName",
-          "source",
-          "agentType",
-          "xdrOperationalStatus",
-          "xdrAgentStatus",
-          "criticalVulnerabilities",
-          "highVulnerabilities",
-          "potentialImpactLevel",
-          "pathsCount"
+          "assetIp",
+          "pluginName",
+          "severity",
+          "riskLevel",
+          "priorityScore",
+          "knownExploited",
+          "cveId",
+          "subnetIp"
         ],
         "extensions": [],
         "includeRelations": [],
         "allowedSorts": [
-          "ipAddress",
-          "subnetIp",
-          "subnetCidr",
-          "hostName",
-          "source",
-          "agentType",
-          "xdrOperationalStatus",
-          "xdrAgentStatus",
-          "criticalVulnerabilities",
-          "highVulnerabilities",
-          "potentialImpactLevel",
-          "pathsCount",
-          "lastSeen"
+          "assetIp",
+          "pluginName",
+          "severity",
+          "riskLevel",
+          "priorityScore",
+          "knownExploited"
         ],
         "defaultSort": {
-          "property": "ipAddress",
+          "property": "pluginName",
           "direction": "asc"
         },
         "allowSortDrivenLeadingOverride": false
@@ -2119,26 +3827,75 @@
         ]
       },
       "data": {
-        "id": "subnets-main-list",
-        "entity": "subnets",
-        "title": "Subnets",
-        "leadingContentType": "snapshots",
+        "id": "vulnerabilities-exploitability-analysis-list",
+        "entity": "vulnerabilities",
+        "title": "Vulnerabilities Exploitability",
+        "leadingContentType": "analysis",
+        "pagination": {
+          "enabled": true,
+          "defaultLimit": 50,
+          "maxLimit": 200
+        },
+        "filters": [],
         "fields": [
-          "cidr",
-          "subnetIp",
-          "zone",
-          "vr",
-          "recordId"
+          "analysisBriefSummary",
+          "analysisBriefAnalysis",
+          "analysisExploitabilityLevel",
+          "analysisClassType"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "analysisExploitabilityLevel",
+          "analysisClassType"
         ],
         "defaultSort": {
-          "property": "cidr",
+          "property": "analysisExploitabilityLevel",
           "direction": "asc"
         },
+        "allowSortDrivenLeadingOverride": false
+      }
+    },
+    {
+      "catalogId": "lists",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "vulnerabilities-triage-analysis-list",
+        "entity": "vulnerabilities",
+        "title": "Vulnerabilities Triage",
+        "leadingContentType": "analysis",
         "pagination": {
           "enabled": true,
           "defaultLimit": 50,
           "maxLimit": 200
-        }
+        },
+        "filters": [],
+        "fields": [
+          "analysisBriefSummary",
+          "analysisBriefAnalysis",
+          "analysisExploitabilityLevel",
+          "analysisClassType",
+          "analysisImpact"
+        ],
+        "extensions": [],
+        "includeRelations": [],
+        "allowedSorts": [
+          "analysisExploitabilityLevel",
+          "analysisClassType"
+        ],
+        "defaultSort": {
+          "property": "analysisExploitabilityLevel",
+          "direction": "asc"
+        },
+        "allowSortDrivenLeadingOverride": false
       }
     },
     {
@@ -2153,9 +3910,9 @@
         ]
       },
       "data": {
-        "id": "vulnerabilities-main-list",
-        "entity": "vulnerabilities",
-        "title": "Vulnerabilities",
+        "id": "vulnerabilities-groups-main-list",
+        "entity": "vulnerabilities-groups",
+        "title": "Vulnerability Groups",
         "leadingContentType": "snapshots",
         "pagination": {
           "enabled": true,
@@ -2164,42 +3921,97 @@
         },
         "filters": [],
         "fields": [
-          "vulnerabilityId",
-          "assetIp",
-          "subnetIp",
-          "pluginName",
-          "pluginFamily",
+          "name",
+          "vulnerabilityType",
           "severity",
-          "cveId",
+          "affectedEntitiesCount",
+          "findingsCount",
+          "vulnerabilitiesCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
           "riskLevel",
           "priorityScore",
-          "epss",
           "knownExploited",
-          "exploitabilityLevel",
-          "networkExposure"
+          "cveId",
+          "pluginId",
+          "compositeScore"
         ],
         "extensions": [],
         "includeRelations": [],
         "allowedSorts": [
-          "vulnerabilityId",
-          "assetIp",
-          "subnetIp",
-          "pluginName",
-          "pluginFamily",
+          "name",
           "severity",
+          "affectedEntitiesCount",
+          "findingsCount",
+          "vulnerabilitiesCount",
+          "criticalVulnerabilities",
+          "highVulnerabilities",
           "riskLevel",
           "priorityScore",
-          "epss",
           "knownExploited",
-          "exploitabilityScore",
-          "exploitabilityLevel",
-          "networkExposure"
+          "compositeScore"
         ],
         "defaultSort": {
           "property": "priorityScore",
           "direction": "desc"
         },
-        "allowSortDrivenLeadingOverride": false
+        "allowSortDrivenLeadingOverride": false,
+        "columnDrillDowns": [
+          {
+            "field": "affectedEntitiesCount",
+            "label": "Affected #",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability"
+              ],
+              "filters": [
+                {
+                  "property": "pluginName",
+                  "operator": "eq",
+                  "valueFromRow": "name"
+                }
+              ]
+            }
+          },
+          {
+            "field": "findingsCount",
+            "label": "Findings #",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-observations-list",
+              "narrativeIds": [
+                "is-finding"
+              ],
+              "filters": [
+                {
+                  "property": "pluginName",
+                  "operator": "eq",
+                  "valueFromRow": "name"
+                }
+              ]
+            }
+          },
+          {
+            "field": "vulnerabilitiesCount",
+            "label": "Vulnerabilities #",
+            "listQuery": {
+              "entityName": "vulnerabilities",
+              "listDescriptorId": "vulnerabilities-main-list",
+              "narrativeIds": [
+                "is-vulnerability"
+              ],
+              "filters": [
+                {
+                  "property": "pluginName",
+                  "operator": "eq",
+                  "valueFromRow": "name"
+                }
+              ]
+            }
+          }
+        ]
       }
     },
     {
@@ -2431,20 +4243,95 @@
         },
         "contentTypes": [
           {
-            "contentType": "snapshots",
-            "required": true,
-            "multiMatch": {
-              "strategy": "last",
-              "effectiveDatePath": "data.lastSeen",
-              "fallbackEffectiveDatePaths": [
-                "capturedAt",
-                "snapshot.capturedAt",
-                "data.lastSeen"
-              ]
-            }
-          }
-        ],
-        "sections": [
+            "contentType": "snapshots",
+            "required": true,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "data.lastSeen",
+              "fallbackEffectiveDatePaths": [
+                "capturedAt",
+                "snapshot.capturedAt",
+                "data.lastSeen"
+              ]
+            }
+          },
+          {
+            "contentType": "analysis",
+            "required": false,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt"
+              ]
+            }
+          },
+          {
+            "contentType": "decisions",
+            "required": false,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt"
+              ]
+            }
+          }
+        ],
+        "sections": [
+          {
+            "id": "brief",
+            "title": "Brief",
+            "fields": [
+              "analysisBriefSummary",
+              "analysisBriefTakeaway",
+              "analysisBriefConfidence"
+            ]
+          },
+          {
+            "id": "context",
+            "title": "Context",
+            "fields": [
+              "analysisContext"
+            ]
+          },
+          {
+            "id": "reachability",
+            "title": "Reachability",
+            "fields": [
+              "analysisReachability"
+            ]
+          },
+          {
+            "id": "paths",
+            "title": "Paths",
+            "fields": [
+              "analysisPaths",
+              "attackPathExistence",
+              "pathsCount"
+            ]
+          },
+          {
+            "id": "exploitability",
+            "title": "Exploitability",
+            "fields": [
+              "decisionExploitability"
+            ]
+          },
+          {
+            "id": "decision",
+            "title": "Decision",
+            "fields": [
+              "decisionOverviewSummary",
+              "decisionOverviewDetailedAnalysis",
+              "decisionLabel",
+              "decisionStatus",
+              "decisionRiskScore",
+              "decisionUrgencyScore"
+            ]
+          },
           {
             "id": "summary",
             "title": "Summary",
@@ -2457,6 +4344,7 @@
               "agentType",
               "xdrOperationalStatus",
               "xdrAgentStatus",
+              "observedUsers",
               "lastSeen",
               "pathsCount"
             ]
@@ -2468,7 +4356,8 @@
               "criticalVulnerabilities",
               "highVulnerabilities",
               "mediumVulnerabilities",
-              "lowVulnerabilities"
+              "lowVulnerabilities",
+              "findingsCount"
             ]
           },
           {
@@ -2479,13 +4368,6 @@
               "potentialImpactConfidence",
               "potentialImpactStory"
             ]
-          },
-          {
-            "id": "xdr",
-            "title": "XDR",
-            "fields": [
-              "rawXdr"
-            ]
           }
         ],
         "includeRelations": [
@@ -2551,6 +4433,18 @@
               ]
             }
           },
+          {
+            "contentType": "analysis",
+            "required": false,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt"
+              ]
+            }
+          },
           {
             "contentType": "legacy",
             "required": false,
@@ -2565,6 +4459,57 @@
           }
         ],
         "sections": [
+          {
+            "id": "overview",
+            "title": "Overview",
+            "fields": [
+              "analysisOverview",
+              "analysisOverviewSummary"
+            ]
+          },
+          {
+            "id": "role",
+            "title": "Role",
+            "fields": [
+              "analysisRole"
+            ]
+          },
+          {
+            "id": "exposure",
+            "title": "Exposure",
+            "fields": [
+              "analysisExposure",
+              "outsideExposureClass"
+            ]
+          },
+          {
+            "id": "trust",
+            "title": "Trust",
+            "fields": [
+              "analysisTrust"
+            ]
+          },
+          {
+            "id": "attack-path",
+            "title": "Attack Path",
+            "fields": [
+              "analysisAttackPath"
+            ]
+          },
+          {
+            "id": "movement",
+            "title": "Movement",
+            "fields": [
+              "analysisMovement"
+            ]
+          },
+          {
+            "id": "context",
+            "title": "Context",
+            "fields": [
+              "analysisContext"
+            ]
+          },
           {
             "id": "summary",
             "title": "Summary",
@@ -2574,6 +4519,11 @@
               "zone",
               "zoneClass",
               "vr",
+              "assetsCount",
+              "findingsCount",
+              "vulnerabilitiesCount",
+              "criticalVulnerabilities",
+              "highVulnerabilities",
               "recordId"
             ]
           },
@@ -2589,15 +4539,6 @@
               "reachableFromZones",
               "zoneMappingConfidence"
             ]
-          },
-          {
-            "id": "legacy",
-            "title": "Legacy (quarantined)",
-            "fields": [
-              "quarantineLegacy",
-              "legacySubnetIp",
-              "quarantineReason"
-            ]
           }
         ],
         "includeRelations": [],
@@ -2637,62 +4578,84 @@
                 "data.enrichment.enrichedAt"
               ]
             }
+          },
+          {
+            "contentType": "analysis",
+            "required": false,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt"
+              ]
+            }
           }
         ],
         "sections": [
           {
-            "id": "summary",
-            "title": "Summary",
+            "id": "brief",
+            "title": "Brief",
             "fields": [
-              "vulnerabilityId",
-              "pluginName",
-              "pluginFamily",
-              "severity",
-              "cveId"
+              "analysisBriefSummary",
+              "analysisBriefAnalysis",
+              "analysisBriefEvidence",
+              "analysisBriefGaps"
             ]
           },
           {
-            "id": "asset",
-            "title": "Affected Asset",
+            "id": "applicability",
+            "title": "Applicability",
             "fields": [
-              "assetIp",
-              "subnetIp",
-              "assetType",
-              "assetZone",
-              "assetHostname",
-              "assetMatched"
+              "analysisApplicability"
             ]
           },
           {
-            "id": "risk",
-            "title": "Risk",
+            "id": "exploitability",
+            "title": "Exploitability",
             "fields": [
-              "riskLevel",
-              "priorityScore",
-              "compositeScore",
-              "exploitabilityScore",
-              "exploitabilityLevel"
+              "analysisExploitability",
+              "analysisExploitabilityLevel"
+            ]
+          },
+          {
+            "id": "impact",
+            "title": "Impact",
+            "fields": [
+              "analysisImpact"
             ]
           },
           {
-            "id": "threatIntelligence",
-            "title": "Threat Intelligence",
+            "id": "threat",
+            "title": "Threat",
             "fields": [
-              "epss",
-              "epssPercentile",
+              "analysisThreat",
               "knownExploited",
-              "cvssBaseScore",
-              "cvssVector"
+              "epss"
             ]
           },
           {
-            "id": "networkAndMitre",
-            "title": "Network & MITRE",
+            "id": "mitre",
+            "title": "Mitre",
             "fields": [
-              "networkExposure",
+              "analysisMitre",
               "mitreTechniques",
               "mitreAnalysis"
             ]
+          },
+          {
+            "id": "summary",
+            "title": "Summary",
+            "fields": [
+              "vulnerabilityId",
+              "pluginName",
+              "pluginFamily",
+              "severity",
+              "cveId",
+              "assetIp",
+              "riskLevel",
+              "priorityScore"
+            ]
           }
         ],
         "includeRelations": [
@@ -2725,6 +4688,188 @@
         }
       }
     },
+    {
+      "catalogId": "memorix-item-descriptors",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "vulnerability-observation-detail-item",
+        "entity": "vulnerabilities",
+        "title": "Observation Detail",
+        "identity": {
+          "idField": "recordId"
+        },
+        "contentTypes": [
+          {
+            "contentType": "snapshots",
+            "required": true,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "data.lastSeen",
+              "fallbackEffectiveDatePaths": [
+                "capturedAt",
+                "snapshot.capturedAt",
+                "data.enrichment.enrichedAt"
+              ]
+            }
+          }
+        ],
+        "sections": [
+          {
+            "id": "brief",
+            "title": "Brief",
+            "fields": [
+              "assetIp",
+              "pluginName",
+              "severity",
+              "cveId",
+              "riskLevel",
+              "priorityScore",
+              "knownExploited"
+            ]
+          }
+        ],
+        "includeRelations": [],
+        "content": {
+          "allowed": false
+        }
+      }
+    },
+    {
+      "catalogId": "memorix-item-descriptors",
+      "scope": {
+        "domains": [
+          "network",
+          "vulnerabilities"
+        ],
+        "agents": [
+          "neo"
+        ]
+      },
+      "data": {
+        "id": "vulnerabilities-group-detail-item",
+        "entity": "vulnerabilities-groups",
+        "title": "Vulnerability Group Detail",
+        "identity": {
+          "idField": "recordId"
+        },
+        "contentTypes": [
+          {
+            "contentType": "snapshots",
+            "required": true,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt",
+                "data.enrichment.enrichedAt"
+              ]
+            }
+          },
+          {
+            "contentType": "analysis",
+            "required": false,
+            "multiMatch": {
+              "strategy": "last",
+              "effectiveDatePath": "capturedAt",
+              "fallbackEffectiveDatePaths": [
+                "modifiedAt",
+                "createdAt"
+              ]
+            }
+          }
+        ],
+        "sections": [
+          {
+            "id": "brief",
+            "title": "Brief",
+            "fields": [
+              "analysisBriefSummary",
+              "analysisBriefAnalysis",
+              "analysisBriefEvidence",
+              "analysisBriefGaps"
+            ]
+          },
+          {
+            "id": "applicability",
+            "title": "Applicability",
+            "fields": [
+              "analysisApplicability"
+            ]
+          },
+          {
+            "id": "exploitability",
+            "title": "Exploitability",
+            "fields": [
+              "analysisExploitability"
+            ]
+          },
+          {
+            "id": "impact",
+            "title": "Impact",
+            "fields": [
+              "analysisImpact"
+            ]
+          },
+          {
+            "id": "threat",
+            "title": "Threat",
+            "fields": [
+              "analysisThreat",
+              "knownExploited"
+            ]
+          },
+          {
+            "id": "mitre",
+            "title": "Mitre",
+            "fields": [
+              "analysisMitre"
+            ]
+          },
+          {
+            "id": "summary",
+            "title": "Summary",
+            "fields": [
+              "name",
+              "vulnerabilityType",
+              "cveId",
+              "pluginId",
+              "severity",
+              "affectedEntitiesCount",
+              "findingsCount",
+              "vulnerabilitiesCount",
+              "riskLevel",
+              "priorityScore"
+            ]
+          }
+        ],
+        "includeRelations": [
+          {
+            "relation": "groupVulnerabilities",
+            "mode": "array",
+            "arrayProperty": "vulnerabilities",
+            "limit": 200,
+            "fields": [
+              "assetIp",
+              "severity",
+              "cveId",
+              "pluginName"
+            ]
+          }
+        ],
+        "content": {
+          "allowed": false
+        }
+      }
+    },
     {
       "catalogId": "memorix-item-descriptors",
       "scope": {