07 — Live Query Examples: Neo4j Cypher Queries

Running Queries Against the Live KGCS Graph

All queries in this section can be executed directly against the KGCS Neo4j database.

Query 1: CVE-2021-44228 Lookup (Systems Agent)

Use Case: When you identify a vulnerability, look up all affected platforms

Cypher Query

MATCH (v:Vulnerability {cveId: "CVE-2021-44228"})
OPTIONAL MATCH (v)-[:CAUSED_BY]->(w:Weakness)
OPTIONAL MATCH (v)-[:HAS_SCORE]->(s:Score)
OPTIONAL MATCH (v)-[:AFFECTS]->(p:PlatformConfiguration)
RETURN
    v.cveId AS CVE,
    w.cweId AS CWE,
    s.baseScore AS CVSS_Score,
    COUNT(DISTINCT p) AS Affected_Platforms
ORDER BY s.baseScore DESC

Expected Results

Explanation

• MATCH (v:Vulnerability ...) — Find the CVE node
• OPTIONAL MATCH (v)-[:CAUSED_BY]-> — Get the root cause (CWE)
• OPTIONAL MATCH (v)-[:HAS_SCORE]-> — Get CVSS score
• OPTIONAL MATCH (v)-[:AFFECTS]-> — Count all affected platforms
• COUNT(DISTINCT p) — Deduplicate platforms
• Result: 619,861 unique platform configurations match the vulnerability

Query 2: Attack Path Analysis (Offensive Agent)

Use Case: Given a weakness, find all techniques an attacker can use

Cypher Query

MATCH (w:Weakness {cweId: "CWE-91"})
  -[:DEMONSTRATED_BY]->(ap:AttackPattern)
  -[:IMPLEMENTS]->(t:Technique)
OPTIONAL MATCH (t)-[:PART_OF]->(tac:Tactic)
OPTIONAL MATCH (t)<-[:SUBTECHNIQUE_OF]-(st:SubTechnique)
RETURN
    w.cweId AS Weakness,
    ap.capecId AS Attack_Pattern,
    t.attackId AS Technique,
    tac.phaseName AS Tactic,
    COLLECT(DISTINCT st.attackId) AS SubTechniques
ORDER BY t.attackId

Expected Results

Explanation

• DEMONSTRATED_BY — Which attack patterns can exploit this weakness?
• IMPLEMENTS — Which ATT&CK techniques do those patterns implement?
• PART_OF — Which tactics do those techniques fall under?
• SUBTECHNIQUE_OF — What are the specific variations (PowerShell, Bash, etc.)?
• Result: 2 CAPEC patterns → 1 T-code with multiple subtechniques

Query 3: Defensive Coverage (Defensive Agent)

Use Case: For a technique, find all detections, mitigations, and deceptions

Cypher Query

MATCH (t:Technique {attackId: "T1059"})
OPTIONAL MATCH (t)-[:MITIGATED_BY]->(d:DefensiveTechnique)
OPTIONAL MATCH (t)-[:DETECTED_BY]->(c:DetectionAnalytic)
OPTIONAL MATCH (t)-[:COUNTERED_BY]->(s:DeceptionTechnique)
OPTIONAL MATCH (e:EngagementConcept)-[:DISRUPTS]->(t)
RETURN
    t.attackId AS Technique,
    COUNT(DISTINCT d) AS Mitigations,
    COUNT(DISTINCT c) AS Detections,
    COUNT(DISTINCT s) AS Deceptions,
    COUNT(DISTINCT e) AS Engagements

Expected Results

Explanation

• MITIGATED_BY — D3FEND techniques to prevent this technique
• DETECTED_BY — CAR analytics to detect this technique
• COUNTERED_BY — SHIELD deception tactics to disrupt this technique
• DISRUPTS — ENGAGE engagement concepts
• Result: Complete defensive coverage with 7+4+3+2 = 16 controls

Query 4: Complete Causal Chain

Use Case: Show the entire path from CVE to all defensive controls

Cypher Query

MATCH (v:Vulnerability {cveId: "CVE-2021-44228"})
  -[:CAUSED_BY]->(w:Weakness)
  -[:DEMONSTRATED_BY]->(ap:AttackPattern)
  -[:IMPLEMENTS]->(t:Technique)
OPTIONAL MATCH (t)-[:MITIGATED_BY]->(d:DefensiveTechnique)
OPTIONAL MATCH (t)-[:DETECTED_BY]->(c:DetectionAnalytic)
RETURN
    v.cveId AS CVE,
    w.cweId AS Root_Cause,
    ap.capecId AS Attack_Pattern,
    t.attackId AS Technique,
    COLLECT(DISTINCT d.d3fendId)[0..3] AS Mitigations_Sample,
    COLLECT(DISTINCT c.analyticId)[0..3] AS Detections_Sample

Expected Results

Explanation

This is the complete KGCS reasoning chain: - Specific CVE → General CWE → Attack Patterns → Techniques → Defenses - Shows how standards connect end-to-end - All relationships are explicitly materialized in the graph

Query 5: Affected Platforms Detail

Use Case: See specific CPE configurations affected by the CVE

Cypher Query

MATCH (v:Vulnerability {cveId: "CVE-2021-44228"})
  -[:AFFECTS]->(pc:PlatformConfiguration)
  -[:MATCHES_PLATFORM]->(p:Platform)
RETURN
    pc.matchCriteriaId AS Config_ID,
    p.vendor AS Vendor,
    p.product AS Product,
    p.version AS Version,
    pc.configStatus AS Status
LIMIT 10

Expected Results (Sample)

Explanation

• AFFECTS relationship connects CVE to PlatformConfiguration nodes
• MATCHES_PLATFORM connects configurations to actual CPE platform nodes
• vendorProduct, version provide the specific platforms affected
• Shows the 619,861 platforms in scope for this CVE

Query 6: Related Weaknesses

Use Case: Find other CVEs that share the same root weakness

Cypher Query

MATCH (w:Weakness {cweId: "CWE-91"})
  <-[:CAUSED_BY]-(v:Vulnerability)
OPTIONAL MATCH (v)-[:HAS_SCORE]->(s:Score)
RETURN
    v.cveId AS CVE,
    s.baseScore AS CVSS_Score,
    v.published AS Published_Date
ORDER BY s.baseScore DESC
LIMIT 20

Expected Results (Sample)

Explanation

• Shows that CWE-91 affects multiple CVEs
• Important for understanding root cause at scale
• If you fix CWE-91 in your software, you prevent multiple CVE variants

Query 7: Agent Coverage Comparison

Use Case: Compare defensive coverage across different techniques

Cypher Query

MATCH (t:Technique)
WITH t
OPTIONAL MATCH (t)-[:MITIGATED_BY]->(d:DefensiveTechnique)
OPTIONAL MATCH (t)-[:DETECTED_BY]->(c:DetectionAnalytic)
OPTIONAL MATCH (t)-[:COUNTERED_BY]->(s:DeceptionTechnique)
RETURN
    t.attackId AS Technique,
    COUNT(DISTINCT d) AS Mitigations,
    COUNT(DISTINCT c) AS Detections,
    COUNT(DISTINCT s) AS Deceptions,
    (COUNT(DISTINCT d) + COUNT(DISTINCT c) + COUNT(DISTINCT s)) AS Total_Controls
ORDER BY Total_Controls DESC
LIMIT 10

Expected Results

Explanation

• Shows which techniques have best defensive coverage
• Lowest coverage = prioritize defenses there
• T1059 has 14 defensive controls = well-covered
• Techniques with <5 total controls = defense gap

Running These Queries

In Neo4j Browser

1. Navigate to http://localhost:7474 (or your Neo4j instance)
2. Paste any Cypher query above
3. Click "Play" button
4. Results display in table/graph format

Via Python (using neo4j-driver)

from neo4j import GraphDatabase

driver = GraphDatabase.driver("bolt://localhost:7687", auth=("neo4j", "password"))

def run_query(query):
    with driver.session() as session:
        result = session.run(query)
        for record in result:
            print(record)

# Example: Query 1 - CVE Lookup
query = """
MATCH (v:Vulnerability {cveId: "CVE-2021-44228"})
  -[:CAUSED_BY]->(w:Weakness)
  -[:HAS_SCORE]->(s:Score)
RETURN v.cveId, w.cweId, s.baseScore
"""

run_query(query)

Via REST API (using cypher-shell or curl)

curl -X POST http://localhost:7474/db/data/transaction/commit \
  -H "Authorization: Basic bmVvNGo6cGFzc3dvcmQ=" \
  -H "Content-Type: application/json" \
  -d '{
    "statements": [
      {
        "statement": "MATCH (v:Vulnerability {cveId: \"CVE-2021-44228\"}) RETURN v"
      }
    ]
  }'

Query Performance Notes

• Query 1-3 (lookups): < 100ms
• Query 4 (causal chain): < 200ms
• Query 5 (platform enumeration): 500ms-2s (619K records)
• Query 6 (related vulnerabilities): < 100ms
• Query 7 (coverage comparison): 1-5s (full technique scan)

All queries are indexed on CVE ID, CWE ID, and Attack ID for fast lookups.

Next Steps

Try running these queries! Against your KGCS Neo4j instance and see the actual graph data.

• Modify Query 1: Change CVE-2021-44228 to another CVE you care about
• Modify Query 3: Change T1059 to another ATT&CK technique
• Extend Queries: Add additional MATCH clauses to explore the graph deeper

All queries are parameterized (use $variables in production to prevent injection)