07 — Live Query Examples: Cypher Queries for CWE-89

Query 1: All CVEs for SQL Injection

MATCH (w:Weakness {cweId: "CWE-89"})
  <-[:CAUSED_BY]-(v:Vulnerability)
OPTIONAL MATCH (v)-[:HAS_SCORE]->(s:Score)
RETURN
  v.cveId AS CVE,
  s.baseScore AS CVSS,
  COUNT(*) AS Count
ORDER BY s.baseScore DESC
LIMIT 20

Query 2: Attack Patterns to Techniques

MATCH (w:Weakness {cweId: "CWE-89"})
  -[:DEMONSTRATED_BY]->(ap:AttackPattern)
  -[:IMPLEMENTS]->(t:Technique)
RETURN
  w.cweId,
  ap.capecId,
  t.attackId,
  t.name

Query 3: Complete Defensive Coverage

MATCH (t:Technique {attackId: "T1190"})
OPTIONAL MATCH (t)-[:MITIGATED_BY]->(d:DefensiveTechnique)
OPTIONAL MATCH (t)-[:DETECTED_BY]->(c:DetectionAnalytic)
RETURN
  COUNT(DISTINCT d) AS Mitigations,
  COUNT(DISTINCT c) AS Detections,
  COLLECT(DISTINCT d.d3fendId) AS D3FEND_Techniques,
  COLLECT(DISTINCT c.analyticId) AS CAR_Analytics

Next: 08 vs LLM Comparison (deferred)