Agent-Consumable Graph Schema
Purpose
Provide a simplified Neo4j schema view for agents while preserving KGCS causal invariants.
Labels and Key Properties
- Platform: cpeUri, cpeNameId
- PlatformConfiguration: matchCriteriaId, bounds fields
- Vulnerability: cveId, published, lastModified
- Weakness: cweId, abstraction
- AttackPattern: capecId
- Technique: attackId, name
- SubTechnique: attackId, name
- Tactic: attackId, phaseName
- DefensiveTechnique: d3fendId
- DetectionAnalytic: analyticId
- DeceptionTechnique: techniqueId
- EngagementConcept: activityId, approachId, goalId
- Reference: referenceUrl
- Score: scoreId, baseScore, version
- Consequence, Prerequisite, D3fendResource: uri
Relationship Types
- AFFECTS (PlatformConfiguration <- Vulnerability)
- CAUSED_BY (Vulnerability -> Weakness)
- HAS_SCORE (Vulnerability -> Score)
- REFERENCES (Vulnerability -> Reference)
- EXPLOITED_BY (Weakness -> AttackPattern)
- IMPLEMENTED_AS (AttackPattern -> Technique)
- PART_OF (Technique -> Tactic)
- SUBTECHNIQUE_OF (SubTechnique -> Technique)
- MITIGATED_BY (Technique -> DefensiveTechnique)
- DETECTED_BY (Technique -> DetectionAnalytic)
- COUNTERED_BY (Technique -> DeceptionTechnique)
- DISRUPTS (EngagementConcept -> Technique)
- TARGETS (EngagementConcept -> Group; external)
- DEPRECATES (Platform -> Platform)
Loader Mapping Note (Systems Standards Namespaces)
Use this mapping when loading Neo4j labels/edges into standards-aligned ontology terms.
| Graph Artifact | Ontology Term | Notes |
|---|---|---|
(:Vulnerability)-[:AFFECTS]->(:PlatformConfiguration) |
cve:affects (inverse of kgcs:affected_by) |
Systems-agent compatibility edge |
(:Vulnerability)-[:HAS_SCORE]->(:Score) |
cvss:hasScore (subPropertyOf kgcs:scored_by) |
Keep CVSS versioned score nodes |
(:Vulnerability)-[:REFERENCES]->(:Reference) |
cve:references (subPropertyOf kgcs:references) |
Preserve reference provenance |
Platform.cpeUri / PlatformConfiguration.cpeUri |
cpe:cpeUri |
Canonical CPE URI |
Platform.cpeNameId |
cpe:cpeNameId |
NVD CPE name identifier |
Platform.part / vendor / product / version |
cpe:part / cpe:vendor / cpe:product / cpe:version |
CPE identity decomposition fields |
PlatformConfiguration.matchCriteriaId |
cpe:matchCriteriaId |
NVD criteria identity |
PlatformConfiguration.criteria |
cpe:criteria |
Raw NVD CPE criteria expression |
(:PlatformConfiguration)-[:MATCHES_PLATFORM]->(:Platform) |
cpe:matchesPlatform |
Structural join expansion via CPE Match matches[] |
PlatformConfiguration.configStatus |
cpe:configStatus |
Vulnerable/fixed/unknown status |
PlatformConfiguration.vulnerable |
cpe:vulnerable |
CVE cpeMatch applicability flag |
PlatformConfiguration.versionStartIncluding / versionStartExcluding |
cpe:versionStartIncluding / cpe:versionStartExcluding |
Lower version bounds |
PlatformConfiguration.versionEndIncluding / versionEndExcluding |
cpe:versionEndIncluding / cpe:versionEndExcluding |
Upper version bounds |
PlatformConfiguration.created / lastModified / cpeLastModified |
cpe:created / cpe:lastModified / cpe:cpeLastModified |
CPE Match lifecycle timestamps |
Vulnerability.cveId |
cve:cveId |
Canonical CVE identifier |
Vulnerability.published / Vulnerability.lastModified |
cve:published / cve:lastModified |
Authoritative CVE timestamps |
Weakness.cweId / Weakness.abstraction |
cwe:cweId / cwe:abstraction |
Root-cause metadata used by systems views |
Score.scoreId / Score.version / Score.baseScore |
cvss:scoreId / cvss:version / cvss:baseScore |
CVSS identity and numeric severity |
Core causality terms remain unchanged (kgcs:caused_by, kgcs:exploited_by, kgcs:implemented_as).
Constraints and Indexes
Derived from the Neo4j loader:
- Unique constraints on: cpeUri, cpeNameId, matchCriteriaId, cveId, cweId, capecId, attackId, d3fendId, analyticId, techniqueId, activityId, approachId, goalId, referenceUrl, scoreId.
uriindexes per label for relationship resolution.
Traversal Invariants
- Enforce causal chain: CPE → CVE → CWE → CAPEC → ATT&CK → {D3FEND, CAR, SHIELD, ENGAGE}
- No skips: Queries must traverse all hops; e.g., no direct CWE → ATT&CK
- Read-only: No CREATE/MERGE/DELETE
- Provenance: Include source IDs in responses
- Templates only: Use predefined Cypher patterns
Example Cypher (Systems Agent):
MATCH (pc:PlatformConfiguration {matchCriteriaId: $id})<-[:AFFECTS]-(v:Vulnerability)
RETURN v.cveId, v.published
- Always respect the causal chain: PlatformConfiguration ← Vulnerability → Weakness → AttackPattern → Technique → {DefensiveTechnique, DetectionAnalytic, DeceptionTechnique, EngagementConcept}.
- Do not skip layers (e.g., no Platform → Weakness).
- Coverage edges are additive and never replace causality.
Query Safety
- Use approved traversal templates; no freeform cross-layer joins.
- Read-only Cypher with parameterized IDs; no writes or schema operations.
Provenance Expectations
- Every node must carry an external ID property matching its label’s key.
- Responses to agents must include source standards (NVD, MITRE) and the IDs used.
For module load order used by systems-focused loaders, see the OWL imports checklist in docs/03-data-pipeline/pipeline-execution-guide.md.