Case Study Template — Create Your Own

This template guides you through creating a new KGCS case study for any CVE, CWE, or threat scenario.

Prerequisites

Before starting:

• ✅ Select a CVE or CWE that interests you
• ✅ Verify it exists in the KGCS graph (query Neo4j first)
• ✅ Gather data from NVD, MITRE standards, and public documentation
• ✅ Plan 2-3 hours for a complete case study with all 8 sections

Directory Structure

Create a new directory following this pattern:

docs/case-studies/[your-case-name]/
├── index.md                          # Navigation & quick facts
├── 01-vulnerability-overview.md       # CVE/CWE details, timeline, impact
├── 02-root-cause-analysis.md         # Technical deep dive
├── 03-attack-scenarios.md            # CAPEC → ATT&CK → Real attacks
├── 04-detection-coverage.md          # Detection strategies & rules
├── 05-defense-playbook.md            # Mitigation & hardening
├── 06-reasoning-walkthrough.md       # KGCS agent analysis with examples
├── 07-live-query-examples.md         # Cypher queries specific to your case
└── 08-vs-llm-comparison.md           # (Optional/Future) LLM comparison

Step 1: Create index.md

Template Content:

# [Case Name] — [CVE/CWE]

## Quick Navigation

**Difficulty Level:** [Beginner/Intermediate/Advanced]
**Time to Read:** 20-30 minutes (all sections)
**Status:** [Complete (sections 1-7) + Placeholder (section 8)]

### Full Case Study Structure

| Section | Focus | Time |
|---------|-------|------|
| [01 Vulnerability Overview](#) | ... | 5 min |
| [02 Root Cause Analysis](#) | ... | 8 min |
| [03 Attack Scenarios](#) | ... | 7 min |
| [04 Detection Coverage](#) | ... | 6 min |
| [05 Defense Playbook](#) | ... | 8 min |
| [06 Reasoning Walkthrough](#) | ... | 10 min |
| [07 Live Query Examples](#) | ... | 8 min |
| [08 vs LLM Comparison](#) | (Deferred) How KGCS differs | TBD |

## Why This Case Study?

**[Your CVE/CWE]** demonstrates:
- ✅ [Key point 1]
- ✅ [Key point 2]
- ✅ [Key point 3]
- ✅ [Key point 4]

## KGCS Graph Stats

| Metric | Value |
|--------|-------|
| **CVE/CWE** | [CVE-XXX-XXXXX / CWE-XXX] |
| **Related Weaknesses** | [X CVEs / Y CWEs] |
| **Attack Patterns** | [CAPEC-A, CAPEC-B, CAPEC-C] |
| **ATT&CK Techniques** | [T1234, T2345] |
| **Affected Platforms** | [X platforms/systems] |
| **Defensive Controls** | [X total controls] |

## Quick Attack Example

[Provide a simple code example showing the vulnerability and basic exploitation]

## Complete Case Study

**Ready to dive in?** Start with [01 Vulnerability Overview](#)

[Provide entry points for different audiences]

---

*This case study is complete. Sections [01-07] are ready to read.*

Step 2: Create 01-vulnerability-overview.md

Key Content:

# 01 — Vulnerability Overview: [CVE/CWE]

## Quick Facts

| Property | Value |
|----------|-------|
| **CVE ID** | [CVE-XXXX-XXXXX] |
| **Product** | [Product Name] |
| **Severity** | [CVSS Score and severity level] |
| **Vulnerability Type** | [RCE/XSS/LFI/SQLi/etc.] |
| **Affected Versions** | [Version ranges] |
| **Discovered** | [Date YYYY-MM-DD] |
| **Patches Available** | [Yes/No, when] |

## The Problem

[2-3 paragraphs explaining what the vulnerability is and why it matters]

## Impact Assessment

### Scale
- [Number] affected systems
- Industries impacted: [list]

### Severity Drivers
[Explain why this got its CVSS score]

### Real-World Incidents
| Incident | Date | Details |
|----------|------|---------|
| [Incident Name] | [YYYY-MM] | [Brief description] |

## Timeline

| Date | Event |
|------|-------|
| [Date] | [What happened] |

## KGCS Context

In the KGCS graph:
[Describe the causal chain and connections]

## Next Steps

[Provide clear navigation to next section]

Step 3-7: Create Remaining Sections

For each section (02-07): 1. Follow the structure from Log4j case study 2. Adapt content to your CVE/CWE 3. Include: - Clear headings and sections - Code/query examples where applicable - Tables for comparison - Mermaid diagrams for visualization - At least one Cypher query unique to your case

Step 8: Create Placeholder

# 08 — LLM Comparison (Deferred)

*This section has been deferred for a future update.*

## Coming Soon

**Planned Content:**
[Describe what will go here when complete]

Key Guidelines

Quality Standards

• ✅ All facts verified against NVD or MITRE standards
• ✅ No hallucinations or invented data
• ✅ All sources cited
• ✅ Cypher queries validated against live graph
• ✅ Markdown renders correctly
• ✅ External links valid (tested)

Content Requirements

• ✅ Minimum 500 words per section
• ✅ At least 2-3 visuals (diagrams/tables/code blocks) per section
• ✅ Include real-world examples or attacks
• ✅ Show KGCS advantage (deterministic + transparent + standards-backed)

Writing Style

• ✅ Clear, concise language
• ✅ Avoid marketing hype (be objective)
• ✅ Use active voice
• ✅ Provide clear examples
• ✅ Structure with headers and whitespace

Template Checklist

Before submitting: - [ ] All 8 sections written (including placeholder for 08) - [ ] Directory created in docs/case-studies/[your-case]/ - [ ] index.md includes navigation table - [ ] All Cypher queries tested and valid - [ ] All external links verified (NVD, MITRE, etc.) - [ ] Markdown renders correctly - [ ] No grammar/spelling errors - [ ] At least 2 images/diagrams per section - [ ] README.md updated with link to new case study - [ ] mkdocs.yml updated with navigation entry

Submission Process

1. Create your case study following this template
2. Test all Cypher queries against your KGCS Neo4j instance
3. Verify all links to external resources
4. Review markdown rendering in MkDocs (mkdocs serve)
5. Submit PR to KGCS repository
6. Add summary of your case study to discussion/PR

Examples

• Simple case: Path Traversal CWE-22 — Common vulnerability, easy to understand
• Complex case: Log4j CVE-2021-44228 — Critical CVE with complex chain
• Intermediate: SQL Injection CWE-89 — Prevalent, multiple CVEs

Helpful Resources

• NVD Search: https://nvd.nist.gov/
• CWE Browse: https://cwe.mitre.org/
• CAPEC Browser: https://capec.mitre.org/
• ATT&CK Matrix: https://attack.mitre.org/
• D3FEND: https://d3fend.mitre.org/
• CAR: https://car.mitre.org/
• SHIELD: https://shield.mitre.org/
• ENGAGE: https://engage.mitre.org/

Support

Questions about case study structure? - Review existing case studies Log4j, SQL Injection, Path Traversal

Need help with Cypher queries? - See Query Examples - Test queries in Neo4j Browser

Found an error? - Submit issue to KGCS repository

Ready to start? Pick a CVE or CWE you find interesting and begin creating your case study!