| { |
| "query_lineage": [ |
| { |
| "input": "Which platforms host the most assets?", |
| "output": { |
| "columns": [ |
| "platform_name" |
| ], |
| "metrics": [ |
| { |
| "label": "asset_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "groupby": [ |
| "platform_name" |
| ], |
| "orderby": [ |
| [ |
| "asset_count", |
| false |
| ] |
| ], |
| "row_limit": 50 |
| } |
| }, |
| { |
| "input": "What are the organizations in my products and components?", |
| "output": { |
| "columns": [ |
| "asset_type", |
| "asset_name" |
| ], |
| "filters": [ |
| { |
| "col": "asset_type", |
| "op": "==", |
| "val": "organization" |
| } |
| ], |
| "metrics": [], |
| "orderby": [ |
| [ |
| "asset_name", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "What are the assets of a product?", |
| "output": { |
| "columns": [ |
| "asset_name ", |
| "asset_type" |
| ], |
| "filters": [ |
| { |
| "col": "logical_app", |
| "op": "==", |
| "val": "Hello_World_Github" |
| } |
| ], |
| "groupby": [], |
| "metrics": [], |
| "orderby": [ |
| [ |
| "asset_type", |
| true |
| ], |
| [ |
| "asset_name", |
| true |
| ] |
| ], |
| "row_limit": 50 |
| } |
| }, |
| { |
| "input": "What are the repositories in my products and components?", |
| "output": { |
| "columns": [ |
| "asset_type", |
| "asset_name" |
| ], |
| "filters": [ |
| { |
| "col": "asset_type", |
| "op": "==", |
| "val": "repo" |
| } |
| ], |
| "metrics": [], |
| "orderby": [ |
| [ |
| "asset_name", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "What are the most common types of assets recorded?", |
| "output": { |
| "columns": [ |
| "asset_type" |
| ], |
| "metrics": [ |
| { |
| "label": "asset_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "groupby": [ |
| "asset_type" |
| ], |
| "orderby": [ |
| [ |
| "asset_count", |
| false |
| ] |
| ], |
| "row_limit": 50 |
| } |
| } |
| ], |
| "query_policy_results": [ |
| { |
| "input": "Which products implement the SSDF initiative?", |
| "output": { |
| "columns": [ |
| "logical_app" |
| ], |
| "filters": [ |
| { |
| "col": "initiative_name", |
| "op": "==", |
| "val": "SSDF" |
| } |
| ], |
| "metrics": [], |
| "groupby": [], |
| "row_limit": 20 |
| } |
| }, |
| { |
| "input": "Which policies are failing the most frequently?", |
| "output": { |
| "columns": [ |
| "rule_name" |
| ], |
| "metrics": [ |
| { |
| "label": "failure_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "filters": [ |
| { |
| "col": "message", |
| "op": "==", |
| "val": "fail" |
| } |
| ], |
| "groupby": [ |
| "rule_name" |
| ], |
| "orderby": [ |
| [ |
| "failure_count", |
| false |
| ] |
| ], |
| "row_limit": 50 |
| } |
| }, |
| { |
| "input": "How has the rate of policy failures changed over time?", |
| "output": { |
| "columns": [ |
| "time_evaluated" |
| ], |
| "metrics": [ |
| { |
| "label": "failure_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "filters": [ |
| { |
| "col": "message", |
| "op": "==", |
| "val": "fail" |
| } |
| ], |
| "groupby": [ |
| "time_evaluated" |
| ], |
| "orderby": [ |
| [ |
| "time_evaluated", |
| true |
| ] |
| ], |
| "row_limit": 50 |
| } |
| }, |
| { |
| "input": "Which targets are evaluated most frequently in policy checks?", |
| "output": { |
| "columns": [ |
| "asset_name" |
| ], |
| "metrics": [ |
| { |
| "label": "evaluation_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "groupby": [ |
| "asset_name" |
| ], |
| "orderby": [ |
| [ |
| "evaluation_count", |
| false |
| ] |
| ], |
| "row_limit": 50 |
| } |
| }, |
| { |
| "input": "Which initiatives have the highest policy failure rates?", |
| "output": { |
| "columns": [ |
| "initiative_name" |
| ], |
| "metrics": [ |
| { |
| "label": "failure_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "filters": [ |
| { |
| "col": "message", |
| "op": "==", |
| "val": "fail" |
| } |
| ], |
| "groupby": [ |
| "initiative_name" |
| ], |
| "orderby": [ |
| [ |
| "failure_count", |
| false |
| ] |
| ], |
| "row_limit": 50 |
| } |
| }, |
| { |
| "input": "At which gates do policies most commonly fail?", |
| "output": { |
| "columns": [], |
| "metrics": [ |
| { |
| "label": "failure_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "filters": [ |
| { |
| "col": "message", |
| "op": "==", |
| "val": "fail" |
| } |
| ], |
| "groupby": [], |
| "orderby": [ |
| [ |
| "failure_count", |
| false |
| ] |
| ], |
| "row_limit": 50 |
| } |
| }, |
| { |
| "input": "What is the distribution of policy evaluation statuses?", |
| "output": { |
| "columns": [ |
| "message" |
| ], |
| "metrics": [ |
| { |
| "label": "status_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "groupby": [ |
| "message" |
| ], |
| "row_limit": 50 |
| } |
| }, |
| { |
| "input": "Which product versions experience the most policy failures?", |
| "output": { |
| "columns": [ |
| "logical_app", |
| "logical_app_version" |
| ], |
| "metrics": [ |
| { |
| "label": "failure_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "filters": [ |
| { |
| "col": "message", |
| "op": "==", |
| "val": "fail" |
| } |
| ], |
| "groupby": [ |
| "logical_app", |
| "logical_app_version" |
| ], |
| "orderby": [ |
| [ |
| "failure_count", |
| false |
| ] |
| ], |
| "row_limit": 50 |
| } |
| }, |
| { |
| "input": "Which general rules are failing the most?", |
| "output": { |
| "columns": [ |
| "rule_name" |
| ], |
| "metrics": [ |
| { |
| "label": "failure_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "filters": [ |
| { |
| "col": "message", |
| "op": "==", |
| "val": "fail" |
| } |
| ], |
| "groupby": [ |
| "rule_name" |
| ], |
| "orderby": [ |
| [ |
| "failure_count", |
| false |
| ] |
| ], |
| "row_limit": 50 |
| } |
| } |
| ], |
| "query_products": [ |
| { |
| "input": "What python packages are in the base layers?", |
| "output": { |
| "columns": [ |
| "component_name", |
| "component_purl", |
| "base_layer" |
| ], |
| "filters": [ |
| { |
| "col": "component_purl", |
| "op": "like", |
| "val": "%pypi%" |
| }, |
| { |
| "col": "base_layer", |
| "op": "==", |
| "val": "TRUE" |
| } |
| ], |
| "metrics": [], |
| "orderby": [ |
| [ |
| "component_name", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "What are the base layer values?", |
| "output": { |
| "columns": [ |
| "base_layer" |
| ], |
| "metrics": [ |
| { |
| "label": "base_layer_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "groupby": [ |
| "base_layer" |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "What npm packages have non-permissive licenses?", |
| "output": { |
| "columns": [ |
| "component_name", |
| "component_purl", |
| "license_expression" |
| ], |
| "filters": [ |
| { |
| "col": "component_purl", |
| "op": "like", |
| "val": "%pkg:npm%" |
| }, |
| { |
| "col": "license_expression", |
| "op": "like", |
| "val": "%GPL%" |
| } |
| ], |
| "metrics": [], |
| "orderby": [ |
| [ |
| "component_name", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "How many npm packages are in my products?", |
| "output": { |
| "columns": [], |
| "filters": [ |
| { |
| "col": "component_purl", |
| "op": "like", |
| "val": "%pkg:npm%" |
| } |
| ], |
| "metrics": [ |
| { |
| "label": "npm_component_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "orderby": [], |
| "row_limit": 1 |
| } |
| }, |
| { |
| "input": "What are the high-level components of a product?", |
| "output": { |
| "columns": [ |
| "targetName" |
| ], |
| "filters": [ |
| { |
| "col": "logical_app", |
| "op": "==", |
| "val": "Scribot" |
| } |
| ], |
| "metrics": [], |
| "orderby": [ |
| [ |
| "targetName", |
| true |
| ] |
| ], |
| "row_limit": 10 |
| } |
| }, |
| { |
| "input": "What are all the components that have the requests package?", |
| "output": { |
| "columns": [ |
| "targetName" |
| ], |
| "filters": [ |
| { |
| "col": "component_name", |
| "op": "==", |
| "val": "requests" |
| } |
| ], |
| "metrics": [], |
| "orderby": [ |
| [ |
| "targetName", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "What are the labels in my products and components?", |
| "output": { |
| "columns": [ |
| "labels" |
| ], |
| "filters": [], |
| "metrics": [], |
| "orderby": [ |
| [ |
| "labels", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| } |
| ], |
| "query_vulnerabilities": [ |
| { |
| "input": "Which components or modules in our software are most frequently associated with vulnerabilities?", |
| "output": { |
| "columns": [ |
| "logical_app", |
| "logical_app_version", |
| "version_timestamp", |
| "component_name" |
| ], |
| "filters": [ |
| { |
| "col": "is_latest_logical_version", |
| "op": "==", |
| "val": true |
| } |
| ], |
| "metrics": [ |
| { |
| "label": "vulnerability_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT()" |
| } |
| ], |
| "orderby": [ |
| [ |
| "vulnerability_count", |
| false |
| ] |
| ], |
| "row_limit": 50 |
| } |
| }, |
| { |
| "input": "How many vulnerabilities that have a patch?", |
| "output": { |
| "columns": [ |
| "logical_app", |
| "logical_app_version" |
| ], |
| "filters": [ |
| { |
| "col": "is_latest_logical_version", |
| "op": "==", |
| "val": true |
| }, |
| { |
| "col": "has_fix", |
| "op": "==", |
| "val": true |
| } |
| ], |
| "metrics": [ |
| { |
| "label": "patchable_vulnerabilities", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT()" |
| } |
| ], |
| "orderby": [ |
| [ |
| "unpatchable_vulnerabilities", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "Which package has most vulnerabilities that the vendor will not fix?", |
| "output": { |
| "columns": [ |
| "component_name", |
| "component_version" |
| ], |
| "filters": [ |
| { |
| "col": "is_latest_logical_version", |
| "op": "==", |
| "val": true |
| }, |
| { |
| "col": "will_not_fix", |
| "op": "==", |
| "val": true |
| } |
| ], |
| "metrics": [ |
| { |
| "label": "not_to_be_fixed_vulnerabilities", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "groupby": [ |
| "logical_app", |
| "logical_app_version", |
| "component_name" |
| ], |
| "orderby": [ |
| [ |
| "unpatchable_vulnerabilities", |
| false |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "Which of my products have a KEV / exploitable vulnerability?", |
| "output": { |
| "columns": [ |
| "logical_app", |
| "vulnerability_id" |
| ], |
| "filters": [ |
| { |
| "col": "is_latest_logical_version", |
| "op": "==", |
| "val": true |
| }, |
| { |
| "col": "has_kev", |
| "op": "==", |
| "val": true |
| } |
| ], |
| "metrics": [], |
| "groupby": [], |
| "orderby": [], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "Which vulnerabilities affect the most of my products?", |
| "output": { |
| "columns": [ |
| "vulnerability_id", |
| "final_severity" |
| ], |
| "filters": [ |
| { |
| "col": "is_latest_logical_version", |
| "op": "==", |
| "val": true |
| } |
| ], |
| "metrics": [ |
| { |
| "label": "product_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(distinct logical_app)" |
| } |
| ], |
| "groupby": [], |
| "orderby": [ |
| [ |
| "final_severity", |
| false |
| ], |
| [ |
| "product_count", |
| false |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "Which vulnerabilities have an Attack Vector: Network (Can be exploited over the network)?", |
| "output": { |
| "columns": [ |
| "logical_app", |
| "vulnerability_id", |
| "vector" |
| ], |
| "filters": [ |
| { |
| "col": "is_latest_logical_version", |
| "op": "==", |
| "val": true |
| }, |
| { |
| "col": "vector", |
| "op": "like", |
| "val": "%AV:N%" |
| } |
| ], |
| "metrics": [], |
| "groupby": [], |
| "orderby": [], |
| "row_limit": 30 |
| } |
| } |
| ], |
| "query_risk": [ |
| { |
| "input": "Which product versions have the highest total risk?", |
| "output": { |
| "columns": [ |
| "logical_app_version", |
| "logical_app", |
| "total_risk" |
| ], |
| "filters": [], |
| "metrics": [], |
| "groupby": [], |
| "orderby": [ |
| [ |
| "total_risk", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "How many fixable CVEs exist in each component?", |
| "output": { |
| "columns": [ |
| "target" |
| ], |
| "filters": [], |
| "metrics": [ |
| { |
| "label": "fixable_cves", |
| "expressionType": "SQL", |
| "sqlExpression": "SUM(target_fixables)" |
| } |
| ], |
| "groupby": [ |
| "target" |
| ], |
| "orderby": [ |
| [ |
| "fixable_cves", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "List the top 10 products by weighted CVE risk.", |
| "output": { |
| "columns": [ |
| "logical_app", |
| "weighted_cve_risk" |
| ], |
| "filters": [], |
| "metrics": [], |
| "groupby": [], |
| "orderby": [ |
| [ |
| "weighted_cve_risk", |
| true |
| ] |
| ], |
| "row_limit": 10 |
| } |
| }, |
| { |
| "input": "Show total exploitables grouped by product version.", |
| "output": { |
| "columns": [ |
| "logical_app_version" |
| ], |
| "filters": [], |
| "metrics": [ |
| { |
| "label": "exploitables", |
| "expressionType": "SQL", |
| "sqlExpression": "SUM(logical_app_version_exploitables)" |
| } |
| ], |
| "groupby": [ |
| "logical_app_version" |
| ], |
| "orderby": [ |
| [ |
| "exploitables", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "Which components have KEVs and are in the base image?", |
| "output": { |
| "columns": [ |
| "target", |
| "vulnerability_id" |
| ], |
| "filters": [ |
| { |
| "col": "has_kev", |
| "op": "==", |
| "val": true |
| }, |
| { |
| "col": "in_base_image", |
| "op": "==", |
| "val": true |
| } |
| ], |
| "metrics": [], |
| "groupby": [], |
| "orderby": [], |
| "row_limit": 30 |
| } |
| } |
| ], |
| "query_findings": [ |
| { |
| "input": "What are the high-severity findings across all tools?", |
| "output": { |
| "columns": [ |
| "title", |
| "severity_string", |
| "main_tool", |
| "logical_app" |
| ], |
| "filters": [ |
| { |
| "col": "severity_string", |
| "op": "in", |
| "val": [ |
| "HIGH", |
| "CRITICAL" |
| ] |
| } |
| ], |
| "metrics": [], |
| "groupby": [], |
| "orderby": [ |
| [ |
| "severity_string", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "How many findings exist for each product?", |
| "output": { |
| "columns": [ |
| "logical_app" |
| ], |
| "filters": [], |
| "metrics": [ |
| { |
| "label": "finding_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "groupby": [ |
| "logical_app" |
| ], |
| "orderby": [ |
| [ |
| "finding_count", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "Show me findings with a CVSS score above 7.", |
| "output": { |
| "columns": [ |
| "title", |
| "cvssv3", |
| "logical_app", |
| "component_name" |
| ], |
| "filters": [ |
| { |
| "col": "cvssv3", |
| "op": ">", |
| "val": "7" |
| } |
| ], |
| "metrics": [], |
| "groupby": [], |
| "orderby": [], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "Which tools produce the most findings?", |
| "output": { |
| "columns": [ |
| "main_tool" |
| ], |
| "filters": [], |
| "metrics": [ |
| { |
| "label": "total_findings", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "groupby": [ |
| "main_tool" |
| ], |
| "orderby": [ |
| [ |
| "total_findings", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| }, |
| { |
| "input": "What types of CWEs are most commonly reported?", |
| "output": { |
| "columns": [ |
| "cwe_id" |
| ], |
| "filters": [], |
| "metrics": [ |
| { |
| "label": "cwe_count", |
| "expressionType": "SQL", |
| "sqlExpression": "COUNT(*)" |
| } |
| ], |
| "groupby": [ |
| "cwe_id" |
| ], |
| "orderby": [ |
| [ |
| "cwe_count", |
| true |
| ] |
| ], |
| "row_limit": 30 |
| } |
| } |
| ] |
| } |
