06 — Reasoning Walkthrough: KGCS SQL Injection Analysis

Systems Agent: CWE-89 Lookup

Query: Find all CVEs related to SQL Injection

{
  "correlation_id": "sqli-demo-systems-01",
  "intent": "vuln_lookup",
  "data": {"cweId": "CWE-89"}
}

Response (Summary):

{
  "vulnerabilities": [
    {"cveId": "CVE-2019-14540", "cweId": "CWE-89", "baseScore": 8.6},
    {"cveId": "CVE-2020-5410", "cweId": "CWE-89", "baseScore": 7.4},
    "... 100+ more CVEs"
  ],
  "confidence": 0.98
}

Offensive Agent: CWE-89 to ATT&CK

Query: How do attackers exploit SQL Injection?

{
  "correlation_id": "sqli-demo-offensive-01",
  "intent": "attack_path",
  "data": {"cweId": "CWE-89"}
}

Response:

{
  "techniques": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "capec": ["CAPEC-66", "CAPEC-250"]
    }
  ],
  "confidence": 0.95
}

Defensive Agent: T1190 Coverage

Query: How do we defend against SQL Injection?

{
  "correlation_id": "sqli-demo-defensive-01",
  "intent": "coverage_map",
  "data": {"attackId": "T1190"}
}

Response:

{
  "mitigations": 20,
  "detections": 8,
  "deceptions": 2,
  "summary": {
    "total_controls": 30,
    "has_coverage": true
  },
  "confidence": 0.92
}

Next: 07 Live Query Examples