@x12i/memorix-retrieval 1.35.0 → 1.37.0

package/catalox-seeds/inputs/entity-descriptors/assets.json

@@ -82,6 +82,32 @@
       "item": true,
       "valueType": "array"
     },
+    "subnetCidr": {
+      "label": "Subnet CIDR",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.subnetCidrs.0"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "subnetIp": {
+      "label": "Subnet IP",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.subnets.0.networkAddress"
+      },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
     "subnets": {
       "label": "Resolved Subnets",
       "source": {
@@ -438,6 +464,46 @@
       "list": true,
       "item": true,
       "valueType": "number"
+    },
+    "impactDecisionLabel": {
+      "label": "Impact Decision",
+      "source": { "contentType": "decisions", "path": "data.impactDecision.decision" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "impactDecisionStatus": {
+      "label": "Impact Decision Status",
+      "source": { "contentType": "decisions", "path": "data.impactDecision.status" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "string"
+    },
+    "impactDecisionRiskScore": {
+      "label": "Impact Decision Score",
+      "source": { "contentType": "decisions", "path": "data.impactDecision.riskScore" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
+    },
+    "impactDecisionUrgencyScore": {
+      "label": "Impact Urgency Score",
+      "source": { "contentType": "decisions", "path": "data.impactDecision.urgencyScore" },
+      "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
+      "list": true,
+      "item": true,
+      "valueType": "number"
     }
   },
   "associatedProperties": [
@@ -768,5 +834,105 @@
         "cveId"
       ]
     }
+  },
+  "graph": {
+    "node": {
+      "kind": "ipAddress",
+      "directoryFields": ["ipAddress", "hostType", "zones"],
+      "contentLenses": ["snapshot", "analysis", "decisions"],
+      "ui": { "icon": "server" }
+    },
+    "edgeTemplates": [
+      {
+        "id": "asset-topology-associated",
+        "source": { "kind": "associatedArray", "key": "associatedTopology" },
+        "edges": [
+          {
+            "type": "containedIn",
+            "from": { "source": "concept" },
+            "to": { "source": "itemField", "field": "cidr", "kind": "cidr" },
+            "toObjectType": "subnets",
+            "toKind": "cidr",
+            "when": { "itemFieldExists": "cidr" }
+          },
+          {
+            "type": "inZone",
+            "from": { "source": "itemField", "field": "cidr", "kind": "cidr" },
+            "to": { "source": "itemField", "field": "zone", "kind": "zoneName" },
+            "toObjectType": "topology-zones",
+            "toKind": "zoneName",
+            "when": { "itemFieldExists": "zone" }
+          },
+          {
+            "type": "reachableFrom",
+            "from": { "source": "itemArrayField", "field": "reachableFromZones", "kind": "zoneName" },
+            "to": { "source": "itemField", "field": "zone", "kind": "zoneName" },
+            "toObjectType": "topology-zones",
+            "toKind": "zoneName",
+            "when": { "itemFieldExists": "zone" }
+          },
+          {
+            "type": "pathBridge",
+            "from": { "source": "literal", "kind": "zoneName", "value": "OUTSIDE" },
+            "to": { "source": "itemField", "field": "zone", "kind": "zoneName" },
+            "toObjectType": "topology-zones",
+            "toKind": "zoneName",
+            "synthesizePath": { "titleTemplate": "{from} → {to}" },
+            "when": {
+              "itemFieldExists": "zone",
+              "itemArrayIncludes": { "field": "reachableFromZones", "value": "OUTSIDE" }
+            }
+          },
+          {
+            "type": "observedInZone",
+            "from": { "source": "concept" },
+            "to": { "source": "itemField", "field": "zone", "kind": "zoneName" },
+            "toObjectType": "topology-zones",
+            "toKind": "zoneName",
+            "when": { "itemFieldExists": "zone", "itemFieldMissing": "cidr" }
+          }
+        ]
+      },
+      {
+        "id": "asset-vulnerabilities-by-ip",
+        "source": {
+          "kind": "queryByField",
+          "objectType": "vulnerabilities",
+          "sourcePath": "data.assetIp",
+          "targetPath": "data.assetIp",
+          "limit": 50
+        },
+        "edges": [
+          {
+            "type": "affectsAsset",
+            "from": { "source": "relatedConcept" },
+            "to": { "source": "concept" },
+            "toObjectType": "vulnerabilities",
+            "toKind": "hostVulnerability",
+            "neighbor": "from"
+          }
+        ]
+      },
+      {
+        "id": "asset-subnets-by-cidr",
+        "source": {
+          "kind": "queryByField",
+          "objectType": "subnets",
+          "sourcePath": "data.subnetCidrs",
+          "targetPath": "data.cidr",
+          "limit": 20
+        },
+        "edges": [
+          {
+            "type": "containedIn",
+            "from": { "source": "concept" },
+            "to": { "source": "relatedConcept" },
+            "toObjectType": "subnets",
+            "toKind": "cidr",
+            "neighbor": "to"
+          }
+        ]
+      }
+    ]
   }
 }

package/catalox-seeds/inputs/entity-descriptors/subnets.json

@@ -535,6 +535,7 @@
         "inputKind": "cidr",
         "outputKind": "cidr-path-facts",
         "writeToInsights": false,
+        "writeToRootProperty": "possiblePaths",
         "sources": {
           "topologyDb": "memorix-knowledge",
           "topologyCollection": "topology-raw"
@@ -558,5 +559,118 @@
       ]
     }
   },
-  "relations": {}
+  "relations": {
+    "subnetAssets": {
+      "targetEntity": "assets",
+      "type": "oneToMany",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.cidr"
+      },
+      "target": {
+        "contentType": "snapshots",
+        "path": "data.subnetCidrs"
+      },
+      "defaultMode": "array",
+      "defaultArrayProperty": "associatedAssetsSnapshots",
+      "targetFields": [
+        "ipAddress",
+        "hostName",
+        "hostType",
+        "zones"
+      ]
+    },
+    "subnetZone": {
+      "targetEntity": "topology-zones",
+      "type": "manyToOne",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.zone"
+      },
+      "target": {
+        "contentType": "snapshots",
+        "path": "data.name"
+      },
+      "defaultMode": "array",
+      "defaultArrayProperty": "associatedTopologyZonesSnapshots",
+      "targetFields": [
+        "name",
+        "zoneClass"
+      ]
+    }
+  },
+  "narratives": {
+    "has-assets": {
+      "label": "Has assets",
+      "displayName": "Has assets",
+      "description": "Subnet has one or more associated asset snapshots (associatedAssetsSnapshots).",
+      "kind": "having-signal",
+      "visibility": "user",
+      "sourceRef": "associatedAssetsSnapshots",
+      "targetEntity": "assets"
+    },
+    "has-possible-paths": {
+      "label": "Has possible paths",
+      "displayName": "Has possible paths",
+      "description": "Subnet snapshot has non-empty possiblePaths root property (topology path facts).",
+      "kind": "having-signal",
+      "visibility": "user",
+      "sourceRef": "possiblePaths"
+    }
+  },
+  "graph": {
+    "node": {
+      "kind": "cidr",
+      "directoryFields": ["cidr", "zone"],
+      "contentLenses": ["snapshot", "analysis"],
+      "ui": { "icon": "network" }
+    },
+    "edgeTemplates": [
+      {
+        "id": "subnet-zone-topology",
+        "source": {
+          "kind": "queryByField",
+          "objectType": "topology-zones",
+          "sourcePath": "data.zone",
+          "targetPath": "data.name",
+          "limit": 5
+        },
+        "edges": [
+          {
+            "type": "inZone",
+            "from": { "source": "concept" },
+            "to": { "source": "relatedConcept" },
+            "toObjectType": "topology-zones",
+            "toKind": "zoneName",
+            "neighbor": "to"
+          }
+        ]
+      },
+      {
+        "id": "subnet-assets-by-cidr",
+        "source": {
+          "kind": "queryByField",
+          "objectType": "assets",
+          "sourcePath": "data.cidr",
+          "targetPath": "data.subnetCidrs",
+          "limit": 50
+        },
+        "edges": [
+          {
+            "type": "containedIn",
+            "from": { "source": "relatedConcept" },
+            "to": { "source": "concept" },
+            "toObjectType": "assets",
+            "toKind": "ipAddress",
+            "neighbor": "from"
+          }
+        ]
+      },
+      {
+        "id": "subnet-path-facts",
+        "source": { "kind": "pathFacts", "key": "possiblePaths" },
+        "edges": []
+      }
+    ]
+  }
 }

package/catalox-seeds/inputs/entity-descriptors/topology-zones.json

@@ -81,5 +81,56 @@
   },
   "associatedProperties": [],
   "processing": {},
-  "relations": {}
+  "relations": {
+    "zoneSubnets": {
+      "targetEntity": "subnets",
+      "type": "oneToMany",
+      "source": {
+        "contentType": "snapshots",
+        "path": "data.name"
+      },
+      "target": {
+        "contentType": "snapshots",
+        "path": "data.zone"
+      },
+      "defaultMode": "array",
+      "defaultArrayProperty": "associatedSubnetsSnapshots",
+      "targetFields": [
+        "cidr",
+        "networkAddress",
+        "zone",
+        "vr"
+      ]
+    }
+  },
+  "graph": {
+    "node": {
+      "kind": "zoneName",
+      "directoryFields": ["name"],
+      "contentLenses": ["snapshot", "analysis"],
+      "ui": { "icon": "shield" }
+    },
+    "edgeTemplates": [
+      {
+        "id": "zone-subnets-by-name",
+        "source": {
+          "kind": "queryByField",
+          "objectType": "subnets",
+          "sourcePath": "data.name",
+          "targetPath": "data.zone",
+          "limit": 50
+        },
+        "edges": [
+          {
+            "type": "inZone",
+            "from": { "source": "relatedConcept" },
+            "to": { "source": "concept" },
+            "toObjectType": "subnets",
+            "toKind": "cidr",
+            "neighbor": "from"
+          }
+        ]
+      }
+    ]
+  }
 }

package/catalox-seeds/inputs/entity-descriptors/vulnerabilities-groups.json

@@ -306,8 +306,8 @@
     "analysisImpact": {
       "label": "Impact",
       "source": { "contentType": "analysis", "path": "data.impact" },
-      "humanReadable": false,
-      "list": false,
+      "humanReadable": true,
+      "list": true,
       "item": true,
       "valueType": "object"
     },
@@ -393,5 +393,13 @@
         "pluginName"
       ]
     }
+  },
+  "graph": {
+    "node": {
+      "kind": "pluginId",
+      "directoryFields": ["name", "severity", "pluginId", "cveId"],
+      "contentLenses": ["snapshot", "analysis"],
+      "ui": { "icon": "bug" }
+    }
   }
 }

package/catalox-seeds/inputs/entity-descriptors/vulnerabilities.json

@@ -442,8 +442,8 @@
     "analysisImpact": {
       "label": "Impact",
       "source": { "contentType": "analysis", "path": "data.impact" },
-      "humanReadable": false,
-      "list": false,
+      "humanReadable": true,
+      "list": true,
       "item": true,
       "valueType": "object"
     },
@@ -475,6 +475,8 @@
       "label": "Exploitability Level (analysis)",
       "source": { "contentType": "analysis", "path": "data.exploitability.exploitability" },
       "humanReadable": true,
+      "sortable": true,
+      "filterable": true,
       "list": true,
       "item": true,
       "valueType": "string"
@@ -653,11 +655,11 @@
         "direction": "parentToChild",
         "source": {
           "contentType": "snapshots",
-          "path": "data.assetIp"
+          "path": "data.assetIps"
         },
         "target": {
           "contentType": "snapshots",
-          "path": "data.assetIps"
+          "path": "data.assetIp"
         }
       }
     ],
@@ -719,14 +721,14 @@
       "displayName": "Vulnerability",
       "description": "Security-impacting scanner result (severity low/medium/high/critical).",
       "kind": "product-narrative",
-      "visibility": "user"
+      "visibility": "internal"
     },
     "is-finding": {
       "label": "Is finding",
       "displayName": "Informational finding",
       "description": "Informational scanner result (severity none/unknown).",
       "kind": "product-narrative",
-      "visibility": "user"
+      "visibility": "internal"
     },
     "has-analysis": {
       "label": "Has analysis",
@@ -762,7 +764,7 @@
       "label": "Has triage decision",
       "displayName": "Triaged",
       "kind": "rollup",
-      "visibility": "user"
+      "visibility": "internal"
     },
     "has-breach-vector": {
       "label": "Breach vector",
@@ -856,5 +858,75 @@
         "vulnerability_family"
       ]
     }
+  },
+  "graph": {
+    "node": {
+      "kind": "hostVulnerability",
+      "directoryFields": ["assetIp", "severity", "vulnerabilityName"],
+      "contentLenses": ["snapshot", "discovery", "analysis", "decisions"],
+      "ui": { "icon": "alert-triangle" }
+    },
+    "edgeTemplates": [
+      {
+        "id": "vuln-affected-asset",
+        "source": {
+          "kind": "queryByField",
+          "objectType": "assets",
+          "sourcePath": "data.assetIp",
+          "targetPath": "data.assetIps",
+          "limit": 5
+        },
+        "edges": [
+          {
+            "type": "affectsAsset",
+            "from": { "source": "concept" },
+            "to": { "source": "relatedConcept" },
+            "toObjectType": "assets",
+            "toKind": "ipAddress",
+            "neighbor": "to"
+          }
+        ]
+      },
+      {
+        "id": "vuln-in-group",
+        "source": {
+          "kind": "queryByField",
+          "objectType": "vulnerabilities-groups",
+          "sourcePath": "data.vulnerabilityName",
+          "targetPath": "data.name",
+          "limit": 5
+        },
+        "edges": [
+          {
+            "type": "inGroup",
+            "from": { "source": "concept" },
+            "to": { "source": "relatedConcept" },
+            "toObjectType": "vulnerabilities-groups",
+            "toKind": "pluginId",
+            "neighbor": "to"
+          }
+        ]
+      },
+      {
+        "id": "vuln-group-by-plugin",
+        "source": {
+          "kind": "queryByField",
+          "objectType": "vulnerabilities-groups",
+          "sourcePath": "data.pluginId",
+          "targetPath": "data.pluginId",
+          "limit": 5
+        },
+        "edges": [
+          {
+            "type": "inGroup",
+            "from": { "source": "concept" },
+            "to": { "source": "relatedConcept" },
+            "toObjectType": "vulnerabilities-groups",
+            "toKind": "pluginId",
+            "neighbor": "to"
+          }
+        ]
+      }
+    ]
   }
 }

package/catalox-seeds/inputs/graph-descriptors/asset-subnet-paths-graph.json

@@ -0,0 +1,41 @@
+{
+  "id": "asset-subnet-paths-graph",
+  "title": "Asset → subnet → paths",
+  "focusObjectType": "assets",
+  "maxDepth": 3,
+  "includeEdgeTemplates": [
+    "asset-subnets-by-cidr",
+    "asset-topology-associated",
+    "subnet-zone-topology",
+    "subnet-assets-by-cidr",
+    "subnet-path-facts",
+    "zone-subnets-by-name"
+  ],
+  "tiers": [
+    {
+      "id": "topology",
+      "label": "Topology",
+      "objectTypes": ["assets", "subnets", "topology-zones"]
+    }
+  ],
+  "nodes": [
+    { "objectType": "assets", "tier": "topology" },
+    { "objectType": "subnets", "tier": "topology" },
+    { "objectType": "topology-zones", "tier": "topology" }
+  ],
+  "directory": {
+    "defaultObjectTypes": ["assets", "subnets", "topology-zones"],
+    "searchFields": ["title", "identifierKey"],
+    "narrativeFiltersByObjectType": {
+      "subnets": [
+        { "key": "has-assets", "label": "Has assets" },
+        { "key": "has-possible-paths", "label": "Has possible paths" }
+      ]
+    }
+  },
+  "ui": {
+    "icon": "network",
+    "group": "network",
+    "order": 30
+  }
+}

package/catalox-seeds/inputs/graph-descriptors/asset-topology-vulnerabilities-graph.json

@@ -0,0 +1,81 @@
+{
+  "id": "asset-topology-vulnerabilities-graph",
+  "title": "Asset topology & vulnerabilities",
+  "focusObjectType": "assets",
+  "maxDepth": 3,
+  "includeEdgeTemplates": [
+    "asset-topology-associated",
+    "asset-subnets-by-cidr",
+    "asset-vulnerabilities-by-ip",
+    "vuln-affected-asset",
+    "vuln-in-group",
+    "vuln-group-by-plugin",
+    "subnet-zone-topology",
+    "subnet-assets-by-cidr",
+    "subnet-path-facts",
+    "zone-subnets-by-name"
+  ],
+  "tiers": [
+    {
+      "id": "topology",
+      "label": "Topology",
+      "objectTypes": ["assets", "subnets", "topology-zones"]
+    },
+    {
+      "id": "vulnerabilities",
+      "label": "Vulnerabilities",
+      "objectTypes": ["vulnerabilities", "vulnerabilities-groups"]
+    }
+  ],
+  "nodes": [
+    { "objectType": "assets", "tier": "topology" },
+    { "objectType": "subnets", "tier": "topology" },
+    { "objectType": "topology-zones", "tier": "topology" },
+    { "objectType": "vulnerabilities-groups", "tier": "vulnerabilities" },
+    { "objectType": "vulnerabilities", "tier": "vulnerabilities" }
+  ],
+  "directory": {
+    "defaultObjectTypes": [
+      "assets",
+      "subnets",
+      "topology-zones",
+      "vulnerabilities",
+      "vulnerabilities-groups"
+    ],
+    "searchFields": ["title", "identifierKey"],
+    "narrativeFiltersByObjectType": {
+      "assets": [
+        { "key": "has-vulnerabilities", "label": "Has vulnerabilities" },
+        { "key": "has-no-vulnerabilities", "label": "No vulnerabilities" },
+        { "key": "is-triaged", "label": "Is triaged" },
+        { "key": "has-lateral-movement-risk", "label": "Lateral movement risk" },
+        { "key": "has-critical-predicted-impact", "label": "Critical predicted impact" },
+        { "key": "has-high-or-critical-exploitability", "label": "High or critical exploitability" }
+      ],
+      "vulnerabilities": [
+        { "key": "has-critical-severity", "label": "Critical severity" },
+        { "key": "has-high-severity", "label": "High severity" },
+        { "key": "has-medium-severity", "label": "Medium severity" },
+        { "key": "has-breach-vector", "label": "Breach vector" }
+      ],
+      "vulnerabilities-groups": [
+        { "key": "has-critical-severity", "label": "Critical severity" },
+        { "key": "has-high-severity", "label": "High severity" },
+        { "key": "has-medium-severity", "label": "Medium severity" },
+        { "key": "has-low-severity", "label": "Low severity" }
+      ],
+      "subnets": [
+        { "key": "has-assets", "label": "Has assets" },
+        { "key": "has-possible-paths", "label": "Has possible paths" }
+      ],
+      "topology-zones": [
+        { "key": "has-analysis", "label": "Has analysis" }
+      ]
+    }
+  },
+  "ui": {
+    "icon": "network",
+    "group": "network",
+    "order": 10
+  }
+}