KGCS Cybersecurity Agent Demo

v1.0 frozen ontology deterministic reasoning multi-agent orchestration

CPE → CVE → CWE → CAPEC/ATT&CK → D3FEND/CAR/SHIELD/ENGAGE

Problem & Goal

  • Security data is fragmented across standards and tools.
  • Analysts need explainable, provenance-backed answers.
  • KGCS unifies standards into one semantic backbone.
  • Agents provide deterministic responses instead of free-form guessing.

KGCS Semantic Backbone

flowchart LR
  CPE[Platform / PlatformConfiguration] --> CVE[Vulnerability]
  CVE --> CWE[Weakness]
  CWE --> CAPEC[AttackPattern]
  CAPEC --> ATTCK[Technique]
  ATTCK --> D3FEND[DefensiveTechnique]
  ATTCK --> CAR[DetectionAnalytic]
  ATTCK --> SHIELD[DeceptionTechnique]
  ATTCK --> ENGAGE[EngagementConcept]

Invariant: no hop skipping; every edge remains standards-traceable.

Architecture Overview

flowchart TD
  DATA[Authoritative Sources\nNVD + MITRE] --> ETL[ETL Pipeline]
  ETL --> SHACL[SHACL Validation]
  SHACL --> GRAPH[(Neo4j KGCS Graph)]

  USER[User Request] --> ORCH[MasterOrchestrator]
  ORCH --> SYS[Systems Agent]
  ORCH --> OFF[Offensive Agent]
  ORCH --> DEF[Defensive Agent]

  SYS --> GRAPH
  OFF --> GRAPH
  DEF --> GRAPH

  ORCH --> RESP[Unified Response\nProvenance + Confidence]

Agent Roles

Systems

  • vuln_lookup
  • CPE/CVE → vulnerability + weakness + scores

Offensive

  • attack_path
  • CWE/CVE → CAPEC/ATT&CK techniques

Defensive

  • coverage_map
  • ATT&CK technique → D3FEND/CAR/SHIELD/ENGAGE coverage

Orchestrator

  • mixed intent
  • Chains Systems → Offensive → Defensive

Mixed-Intent Execution

sequenceDiagram
  participant U as User
  participant O as MasterOrchestrator
  participant S as SystemsAgent
  participant F as OffensiveAgent
  participant D as DefensiveAgent

  U->>O: intent=mixed, payload={cveId}
  O->>S: vuln_lookup({cveId/cpe})
  S-->>O: vulnerabilities + cweId
  O->>F: attack_path({cweId})
  F-->>O: techniques + attackId
  O->>D: coverage_map({attackId})
  D-->>O: mitigations/detections/deceptions/engagement
  O-->>U: aggregated envelope\n(provenance + confidence)

Demo Runbook (Live)

# 1) Set env
python -m pip install -r requirements.txt
$env:NEO4J_URI="bolt://localhost:7687"
$env:NEO4J_USER="neo4j"
$env:NEO4J_PASSWORD="yourpassword"

# 2) Load + validate data (one-time)
python scripts/download.py --standard all --validate
python scripts/run_all_etl.py
python scripts/validation/validate_all_standards.py --post-load

Then execute requests via orchestrator.MasterOrchestrator (see README live script).

What to Show in the Demo

  1. vuln_lookup: explain CVE + CWE + CVSS lineage.
  2. attack_path: map weakness to ATT&CK techniques.
  3. coverage_map: show defensive coverage across 4 frameworks.
  4. mixed: one request, full chain, unified confidence/provenance.

Guardrails & Trust

  • Core ontology is frozen and immutable in v1.0.
  • All responses use schema-validated envelopes.
  • Read-only graph access for agents.
  • SHACL + post-load checks enforce invariants.
  • No probabilistic semantics in core reasoning.

Q&A / Next Steps

  • Add organization-specific overlays via extensions (without touching core).
  • Automate recurring validation/reporting in CI.
  • Use this deck as a launch template for stakeholder demos.