Knowledge Graph for CyberSecurity
The single source of truth for semantics and contracts that let AI systems reason about cybersecurity deterministically, through an explicit causal chain.
CPE → CVE/CVSS → CWE → CAPEC → ATT&CK → {D3FEND, CAR, SHIELD, ENGAGE}
What's in the spec
- Ontology — core OWL ontology plus per-standard modules (CPE, CVE, CVSS, CWE, CAPEC, ATT&CK, D3FEND, CAR, SHIELD, ENGAGE)
- Shapes — SHACL validation rules and profiles
- Mappings — standard-to-OWL documentation and coverage matrices
- Contracts — machine-readable JSON Schema specifications for graph schemas and request/response formats
Five doors
Pick the door for what you came to do.
Spec — what is KGCS and how is it designed?
For researchers, architects and reviewers who want the causal chain, the architecture and the reasoning behind it before touching any artifact.
- Documentation index — full docs/ table of contents
- Overview
- Architecture
- Glossary & standard definitions
- Extending KGCS with new standards
- Namespace policy v1.0
- Governance
- Pipeline execution guide
- Browse docs/ — plain folder listing
Ontology — what can I consume, and under what URI?
For tool builders, pipelines, agents and other ontologies that need a stable, citable identifier for every module. The ontology prefix URIs do not move.
- Ontology documentation & module table — OWL, mapping and SHACL shape for every module
- Core ontology v1.0
- Asset extension v1.0
- Schema-to-OWL mappings
- SHACL shapes (browse shapes/)
- Raw artifacts — e.g. core-ontology-v1.0.owl, core.shacl.ttl — every module's OWL and SHACL file is linked from the module table above
Agents — how does an agent reason over the graph?
For people building agents: the contracts, schemas and traversal templates an agent needs to query the graph and stay within its confidence and validation rules.
- Agent-consumable graph schema
- Agent-consumable schema
- Defensive agent — schema view
- Confidence model spec
- RAG traversal templates
- RAG template → SHACL shape mapping
- SHACL validation profiles
- SHACL profiles per trust level
- Rule engine specification v1.0
- Request/response JSON Schema contracts
Case studies — does it actually work?
For the skeptical, the community and anyone evaluating KGCS: real vulnerabilities walked through end to end, reasoning traces included.
- Case studies index (browse case-studies/)
- Log4j — CVE-2021-44228 — complete, 8 steps
- SQL injection — CWE-89 — in progress
- Path traversal — CWE-22 — in progress
Talks — I want the explained version
For a first contact with KGCS, or if you're sitting in the room while someone presents it.
Source of truth
Version 1.0 is frozen; new semantics ship as versioned successors. Apache 2.0 license, attribution preserved for NIST/MITRE intellectual property. The full spec, changelog, shapes, mappings and contracts live in the official repository — that is where changes, issues and versioned releases happen.