Spaces:
Sleeping
Sleeping
| { | |
| "query_lineage": [ | |
| { | |
| "input": "Which platforms host the most assets?", | |
| "output": { | |
| "columns": [ | |
| "platform_name" | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "asset_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "groupby": [ | |
| "platform_name" | |
| ], | |
| "orderby": [ | |
| [ | |
| "asset_count", | |
| false | |
| ] | |
| ], | |
| "row_limit": 50 | |
| } | |
| }, | |
| { | |
| "input": "What are the organizations in my products and components?", | |
| "output": { | |
| "columns": [ | |
| "asset_type", | |
| "asset_name" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "asset_type", | |
| "op": "==", | |
| "val": "organization" | |
| } | |
| ], | |
| "metrics": [], | |
| "orderby": [ | |
| [ | |
| "asset_name", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "What are the assets of a product?", | |
| "output": { | |
| "columns": [ | |
| "asset_name ", | |
| "asset_type" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "logical_app", | |
| "op": "==", | |
| "val": "Hello_World_Github" | |
| } | |
| ], | |
| "groupby": [], | |
| "metrics": [], | |
| "orderby": [ | |
| [ | |
| "asset_type", | |
| true | |
| ], | |
| [ | |
| "asset_name", | |
| true | |
| ] | |
| ], | |
| "row_limit": 50 | |
| } | |
| }, | |
| { | |
| "input": "What are the repositories in my products and components?", | |
| "output": { | |
| "columns": [ | |
| "asset_type", | |
| "asset_name" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "asset_type", | |
| "op": "==", | |
| "val": "repo" | |
| } | |
| ], | |
| "metrics": [], | |
| "orderby": [ | |
| [ | |
| "asset_name", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "What are the most common types of assets recorded?", | |
| "output": { | |
| "columns": [ | |
| "asset_type" | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "asset_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "groupby": [ | |
| "asset_type" | |
| ], | |
| "orderby": [ | |
| [ | |
| "asset_count", | |
| false | |
| ] | |
| ], | |
| "row_limit": 50 | |
| } | |
| } | |
| ], | |
| "query_policy_results": [ | |
| { | |
| "input": "Which products implement the SSDF initiative?", | |
| "output": { | |
| "columns": [ | |
| "logical_app" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "initiative_name", | |
| "op": "==", | |
| "val": "SSDF" | |
| } | |
| ], | |
| "metrics": [], | |
| "groupby": [], | |
| "row_limit": 20 | |
| } | |
| }, | |
| { | |
| "input": "Which policies are failing the most frequently?", | |
| "output": { | |
| "columns": [ | |
| "rule_name" | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "failure_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "filters": [ | |
| { | |
| "col": "message", | |
| "op": "==", | |
| "val": "fail" | |
| } | |
| ], | |
| "groupby": [ | |
| "rule_name" | |
| ], | |
| "orderby": [ | |
| [ | |
| "failure_count", | |
| false | |
| ] | |
| ], | |
| "row_limit": 50 | |
| } | |
| }, | |
| { | |
| "input": "How has the rate of policy failures changed over time?", | |
| "output": { | |
| "columns": [ | |
| "time_evaluated" | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "failure_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "filters": [ | |
| { | |
| "col": "message", | |
| "op": "==", | |
| "val": "fail" | |
| } | |
| ], | |
| "groupby": [ | |
| "time_evaluated" | |
| ], | |
| "orderby": [ | |
| [ | |
| "time_evaluated", | |
| true | |
| ] | |
| ], | |
| "row_limit": 50 | |
| } | |
| }, | |
| { | |
| "input": "Which targets are evaluated most frequently in policy checks?", | |
| "output": { | |
| "columns": [ | |
| "asset_name" | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "evaluation_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "groupby": [ | |
| "asset_name" | |
| ], | |
| "orderby": [ | |
| [ | |
| "evaluation_count", | |
| false | |
| ] | |
| ], | |
| "row_limit": 50 | |
| } | |
| }, | |
| { | |
| "input": "Which initiatives have the highest policy failure rates?", | |
| "output": { | |
| "columns": [ | |
| "initiative_name" | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "failure_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "filters": [ | |
| { | |
| "col": "message", | |
| "op": "==", | |
| "val": "fail" | |
| } | |
| ], | |
| "groupby": [ | |
| "initiative_name" | |
| ], | |
| "orderby": [ | |
| [ | |
| "failure_count", | |
| false | |
| ] | |
| ], | |
| "row_limit": 50 | |
| } | |
| }, | |
| { | |
| "input": "At which gates do policies most commonly fail?", | |
| "output": { | |
| "columns": [], | |
| "metrics": [ | |
| { | |
| "label": "failure_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "filters": [ | |
| { | |
| "col": "message", | |
| "op": "==", | |
| "val": "fail" | |
| } | |
| ], | |
| "groupby": [], | |
| "orderby": [ | |
| [ | |
| "failure_count", | |
| false | |
| ] | |
| ], | |
| "row_limit": 50 | |
| } | |
| }, | |
| { | |
| "input": "What is the distribution of policy evaluation statuses?", | |
| "output": { | |
| "columns": [ | |
| "message" | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "status_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "groupby": [ | |
| "message" | |
| ], | |
| "row_limit": 50 | |
| } | |
| }, | |
| { | |
| "input": "Which product versions experience the most policy failures?", | |
| "output": { | |
| "columns": [ | |
| "logical_app", | |
| "logical_app_version" | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "failure_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "filters": [ | |
| { | |
| "col": "message", | |
| "op": "==", | |
| "val": "fail" | |
| } | |
| ], | |
| "groupby": [ | |
| "logical_app", | |
| "logical_app_version" | |
| ], | |
| "orderby": [ | |
| [ | |
| "failure_count", | |
| false | |
| ] | |
| ], | |
| "row_limit": 50 | |
| } | |
| }, | |
| { | |
| "input": "Which general rules are failing the most?", | |
| "output": { | |
| "columns": [ | |
| "rule_name" | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "failure_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "filters": [ | |
| { | |
| "col": "message", | |
| "op": "==", | |
| "val": "fail" | |
| } | |
| ], | |
| "groupby": [ | |
| "rule_name" | |
| ], | |
| "orderby": [ | |
| [ | |
| "failure_count", | |
| false | |
| ] | |
| ], | |
| "row_limit": 50 | |
| } | |
| } | |
| ], | |
| "query_products": [ | |
| { | |
| "input": "What python packages are in the base layers?", | |
| "output": { | |
| "columns": [ | |
| "component_name", | |
| "component_purl", | |
| "base_layer" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "component_purl", | |
| "op": "like", | |
| "val": "%pypi%" | |
| }, | |
| { | |
| "col": "base_layer", | |
| "op": "==", | |
| "val": "TRUE" | |
| } | |
| ], | |
| "metrics": [], | |
| "orderby": [ | |
| [ | |
| "component_name", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "What are the base layer values?", | |
| "output": { | |
| "columns": [ | |
| "base_layer" | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "base_layer_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "groupby": [ | |
| "base_layer" | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "What npm packages have non-permissive licenses?", | |
| "output": { | |
| "columns": [ | |
| "component_name", | |
| "component_purl", | |
| "license_expression" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "component_purl", | |
| "op": "like", | |
| "val": "%pkg:npm%" | |
| }, | |
| { | |
| "col": "license_expression", | |
| "op": "like", | |
| "val": "%GPL%" | |
| } | |
| ], | |
| "metrics": [], | |
| "orderby": [ | |
| [ | |
| "component_name", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "How many npm packages are in my products?", | |
| "output": { | |
| "columns": [], | |
| "filters": [ | |
| { | |
| "col": "component_purl", | |
| "op": "like", | |
| "val": "%pkg:npm%" | |
| } | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "npm_component_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "orderby": [], | |
| "row_limit": 1 | |
| } | |
| }, | |
| { | |
| "input": "What are the high-level components of a product?", | |
| "output": { | |
| "columns": [ | |
| "targetName" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "logical_app", | |
| "op": "==", | |
| "val": "Scribot" | |
| } | |
| ], | |
| "metrics": [], | |
| "orderby": [ | |
| [ | |
| "targetName", | |
| true | |
| ] | |
| ], | |
| "row_limit": 10 | |
| } | |
| }, | |
| { | |
| "input": "What are all the components that have the requests package?", | |
| "output": { | |
| "columns": [ | |
| "targetName" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "component_name", | |
| "op": "==", | |
| "val": "requests" | |
| } | |
| ], | |
| "metrics": [], | |
| "orderby": [ | |
| [ | |
| "targetName", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "What are the labels in my products and components?", | |
| "output": { | |
| "columns": [ | |
| "labels" | |
| ], | |
| "filters": [], | |
| "metrics": [], | |
| "orderby": [ | |
| [ | |
| "labels", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| } | |
| ], | |
| "query_vulnerabilities": [ | |
| { | |
| "input": "Which components or modules in our software are most frequently associated with vulnerabilities?", | |
| "output": { | |
| "columns": [ | |
| "logical_app", | |
| "logical_app_version", | |
| "version_timestamp", | |
| "component_name" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "is_latest_logical_version", | |
| "op": "==", | |
| "val": true | |
| } | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "vulnerability_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT()" | |
| } | |
| ], | |
| "orderby": [ | |
| [ | |
| "vulnerability_count", | |
| false | |
| ] | |
| ], | |
| "row_limit": 50 | |
| } | |
| }, | |
| { | |
| "input": "How many vulnerabilities that have a patch?", | |
| "output": { | |
| "columns": [ | |
| "logical_app", | |
| "logical_app_version" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "is_latest_logical_version", | |
| "op": "==", | |
| "val": true | |
| }, | |
| { | |
| "col": "has_fix", | |
| "op": "==", | |
| "val": true | |
| } | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "patchable_vulnerabilities", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT()" | |
| } | |
| ], | |
| "orderby": [ | |
| [ | |
| "unpatchable_vulnerabilities", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "Which package has most vulnerabilities that the vendor will not fix?", | |
| "output": { | |
| "columns": [ | |
| "component_name", | |
| "component_version" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "is_latest_logical_version", | |
| "op": "==", | |
| "val": true | |
| }, | |
| { | |
| "col": "will_not_fix", | |
| "op": "==", | |
| "val": true | |
| } | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "not_to_be_fixed_vulnerabilities", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "groupby": [ | |
| "logical_app", | |
| "logical_app_version", | |
| "component_name" | |
| ], | |
| "orderby": [ | |
| [ | |
| "unpatchable_vulnerabilities", | |
| false | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "Which of my products have a KEV / exploitable vulnerability?", | |
| "output": { | |
| "columns": [ | |
| "logical_app", | |
| "vulnerability_id" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "is_latest_logical_version", | |
| "op": "==", | |
| "val": true | |
| }, | |
| { | |
| "col": "has_kev", | |
| "op": "==", | |
| "val": true | |
| } | |
| ], | |
| "metrics": [], | |
| "groupby": [], | |
| "orderby": [], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "Which vulnerabilities affect the most of my products?", | |
| "output": { | |
| "columns": [ | |
| "vulnerability_id", | |
| "final_severity" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "is_latest_logical_version", | |
| "op": "==", | |
| "val": true | |
| } | |
| ], | |
| "metrics": [ | |
| { | |
| "label": "product_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(distinct logical_app)" | |
| } | |
| ], | |
| "groupby": [], | |
| "orderby": [ | |
| [ | |
| "final_severity", | |
| false | |
| ], | |
| [ | |
| "product_count", | |
| false | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "Which vulnerabilities have an Attack Vector: Network (Can be exploited over the network)?", | |
| "output": { | |
| "columns": [ | |
| "logical_app", | |
| "vulnerability_id", | |
| "vector" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "is_latest_logical_version", | |
| "op": "==", | |
| "val": true | |
| }, | |
| { | |
| "col": "vector", | |
| "op": "like", | |
| "val": "%AV:N%" | |
| } | |
| ], | |
| "metrics": [], | |
| "groupby": [], | |
| "orderby": [], | |
| "row_limit": 30 | |
| } | |
| } | |
| ], | |
| "query_risk": [ | |
| { | |
| "input": "Which product versions have the highest total risk?", | |
| "output": { | |
| "columns": [ | |
| "logical_app_version", | |
| "logical_app", | |
| "total_risk" | |
| ], | |
| "filters": [], | |
| "metrics": [], | |
| "groupby": [], | |
| "orderby": [ | |
| [ | |
| "total_risk", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "How many fixable CVEs exist in each component?", | |
| "output": { | |
| "columns": [ | |
| "target" | |
| ], | |
| "filters": [], | |
| "metrics": [ | |
| { | |
| "label": "fixable_cves", | |
| "expressionType": "SQL", | |
| "sqlExpression": "SUM(target_fixables)" | |
| } | |
| ], | |
| "groupby": [ | |
| "target" | |
| ], | |
| "orderby": [ | |
| [ | |
| "fixable_cves", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "List the top 10 products by weighted CVE risk.", | |
| "output": { | |
| "columns": [ | |
| "logical_app", | |
| "weighted_cve_risk" | |
| ], | |
| "filters": [], | |
| "metrics": [], | |
| "groupby": [], | |
| "orderby": [ | |
| [ | |
| "weighted_cve_risk", | |
| true | |
| ] | |
| ], | |
| "row_limit": 10 | |
| } | |
| }, | |
| { | |
| "input": "Show total exploitables grouped by product version.", | |
| "output": { | |
| "columns": [ | |
| "logical_app_version" | |
| ], | |
| "filters": [], | |
| "metrics": [ | |
| { | |
| "label": "exploitables", | |
| "expressionType": "SQL", | |
| "sqlExpression": "SUM(logical_app_version_exploitables)" | |
| } | |
| ], | |
| "groupby": [ | |
| "logical_app_version" | |
| ], | |
| "orderby": [ | |
| [ | |
| "exploitables", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "Which components have KEVs and are in the base image?", | |
| "output": { | |
| "columns": [ | |
| "target", | |
| "vulnerability_id" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "has_kev", | |
| "op": "==", | |
| "val": true | |
| }, | |
| { | |
| "col": "in_base_image", | |
| "op": "==", | |
| "val": true | |
| } | |
| ], | |
| "metrics": [], | |
| "groupby": [], | |
| "orderby": [], | |
| "row_limit": 30 | |
| } | |
| } | |
| ], | |
| "query_findings": [ | |
| { | |
| "input": "What are the high-severity findings across all tools?", | |
| "output": { | |
| "columns": [ | |
| "title", | |
| "severity_string", | |
| "main_tool", | |
| "logical_app" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "severity_string", | |
| "op": "in", | |
| "val": [ | |
| "HIGH", | |
| "CRITICAL" | |
| ] | |
| } | |
| ], | |
| "metrics": [], | |
| "groupby": [], | |
| "orderby": [ | |
| [ | |
| "severity_string", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "How many findings exist for each product?", | |
| "output": { | |
| "columns": [ | |
| "logical_app" | |
| ], | |
| "filters": [], | |
| "metrics": [ | |
| { | |
| "label": "finding_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "groupby": [ | |
| "logical_app" | |
| ], | |
| "orderby": [ | |
| [ | |
| "finding_count", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "Show me findings with a CVSS score above 7.", | |
| "output": { | |
| "columns": [ | |
| "title", | |
| "cvssv3", | |
| "logical_app", | |
| "component_name" | |
| ], | |
| "filters": [ | |
| { | |
| "col": "cvssv3", | |
| "op": ">", | |
| "val": "7" | |
| } | |
| ], | |
| "metrics": [], | |
| "groupby": [], | |
| "orderby": [], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "Which tools produce the most findings?", | |
| "output": { | |
| "columns": [ | |
| "main_tool" | |
| ], | |
| "filters": [], | |
| "metrics": [ | |
| { | |
| "label": "total_findings", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "groupby": [ | |
| "main_tool" | |
| ], | |
| "orderby": [ | |
| [ | |
| "total_findings", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| }, | |
| { | |
| "input": "What types of CWEs are most commonly reported?", | |
| "output": { | |
| "columns": [ | |
| "cwe_id" | |
| ], | |
| "filters": [], | |
| "metrics": [ | |
| { | |
| "label": "cwe_count", | |
| "expressionType": "SQL", | |
| "sqlExpression": "COUNT(*)" | |
| } | |
| ], | |
| "groupby": [ | |
| "cwe_id" | |
| ], | |
| "orderby": [ | |
| [ | |
| "cwe_count", | |
| true | |
| ] | |
| ], | |
| "row_limit": 30 | |
| } | |
| } | |
| ] | |
| } |