{
  "query_lineage": [
    {
      "input": "Which platforms host the most assets?",
      "output": {
        "columns": [
          "platform_name"
        ],
        "metrics": [
          {
            "label": "asset_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "groupby": [
          "platform_name"
        ],
        "orderby": [
          [
            "asset_count",
            false
          ]
        ],
        "row_limit": 50
      }
    },
    {
      "input": "What are the organizations in my products and components?",
      "output": {
        "columns": [
          "asset_type",
          "asset_name"
        ],
        "filters": [
          {
            "col": "asset_type",
            "op": "==",
            "val": "organization"
          }
        ],
        "metrics": [],
        "orderby": [
          [
            "asset_name",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "What are the assets of a product?",
      "output": {
        "columns": [
          "asset_name ",
          "asset_type"
        ],
        "filters": [
          {
            "col": "logical_app",
            "op": "==",
            "val": "Hello_World_Github"
          }
        ],
        "groupby": [],
        "metrics": [],
        "orderby": [
          [
            "asset_type",
            true
          ],
          [
            "asset_name",
            true
          ]
        ],
        "row_limit": 50
      }
    },
    {
      "input": "What are the repositories in my products and components?",
      "output": {
        "columns": [
          "asset_type",
          "asset_name"
        ],
        "filters": [
          {
            "col": "asset_type",
            "op": "==",
            "val": "repo"
          }
        ],
        "metrics": [],
        "orderby": [
          [
            "asset_name",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "What are the most common types of assets recorded?",
      "output": {
        "columns": [
          "asset_type"
        ],
        "metrics": [
          {
            "label": "asset_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "groupby": [
          "asset_type"
        ],
        "orderby": [
          [
            "asset_count",
            false
          ]
        ],
        "row_limit": 50
      }
    }
  ],
  "query_policy_results": [
    {
      "input": "Which products implement the SSDF initiative?",
      "output": {
        "columns": [
          "logical_app"
        ],
        "filters": [
          {
            "col": "initiative_name",
            "op": "==",
            "val": "SSDF"
          }
        ],
        "metrics": [],
        "groupby": [],
        "row_limit": 20
      }
    },
    {
      "input": "Which policies are failing the most frequently?",
      "output": {
        "columns": [
          "rule_name"
        ],
        "metrics": [
          {
            "label": "failure_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "filters": [
          {
            "col": "message",
            "op": "==",
            "val": "fail"
          }
        ],
        "groupby": [
          "rule_name"
        ],
        "orderby": [
          [
            "failure_count",
            false
          ]
        ],
        "row_limit": 50
      }
    },
    {
      "input": "How has the rate of policy failures changed over time?",
      "output": {
        "columns": [
          "time_evaluated"
        ],
        "metrics": [
          {
            "label": "failure_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "filters": [
          {
            "col": "message",
            "op": "==",
            "val": "fail"
          }
        ],
        "groupby": [
          "time_evaluated"
        ],
        "orderby": [
          [
            "time_evaluated",
            true
          ]
        ],
        "row_limit": 50
      }
    },
    {
      "input": "Which targets are evaluated most frequently in policy checks?",
      "output": {
        "columns": [
          "asset_name"
        ],
        "metrics": [
          {
            "label": "evaluation_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "groupby": [
          "asset_name"
        ],
        "orderby": [
          [
            "evaluation_count",
            false
          ]
        ],
        "row_limit": 50
      }
    },
    {
      "input": "Which initiatives have the highest policy failure rates?",
      "output": {
        "columns": [
          "initiative_name"
        ],
        "metrics": [
          {
            "label": "failure_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "filters": [
          {
            "col": "message",
            "op": "==",
            "val": "fail"
          }
        ],
        "groupby": [
          "initiative_name"
        ],
        "orderby": [
          [
            "failure_count",
            false
          ]
        ],
        "row_limit": 50
      }
    },
    {
      "input": "At which gates do policies most commonly fail?",
      "output": {
        "columns": [],
        "metrics": [
          {
            "label": "failure_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "filters": [
          {
            "col": "message",
            "op": "==",
            "val": "fail"
          }
        ],
        "groupby": [],
        "orderby": [
          [
            "failure_count",
            false
          ]
        ],
        "row_limit": 50
      }
    },
    {
      "input": "What is the distribution of policy evaluation statuses?",
      "output": {
        "columns": [
          "message"
        ],
        "metrics": [
          {
            "label": "status_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "groupby": [
          "message"
        ],
        "row_limit": 50
      }
    },
    {
      "input": "Which product versions experience the most policy failures?",
      "output": {
        "columns": [
          "logical_app",
          "logical_app_version"
        ],
        "metrics": [
          {
            "label": "failure_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "filters": [
          {
            "col": "message",
            "op": "==",
            "val": "fail"
          }
        ],
        "groupby": [
          "logical_app",
          "logical_app_version"
        ],
        "orderby": [
          [
            "failure_count",
            false
          ]
        ],
        "row_limit": 50
      }
    },
    {
      "input": "Which general rules are failing the most?",
      "output": {
        "columns": [
          "rule_name"
        ],
        "metrics": [
          {
            "label": "failure_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "filters": [
          {
            "col": "message",
            "op": "==",
            "val": "fail"
          }
        ],
        "groupby": [
          "rule_name"
        ],
        "orderby": [
          [
            "failure_count",
            false
          ]
        ],
        "row_limit": 50
      }
    }
  ],
  "query_products": [
    {
      "input": "What python packages are in the base layers?",
      "output": {
        "columns": [
          "component_name",
          "component_purl",
          "base_layer"
        ],
        "filters": [
          {
            "col": "component_purl",
            "op": "like",
            "val": "%pypi%"
          },
          {
            "col": "base_layer",
            "op": "==",
            "val": "TRUE"
          }
        ],
        "metrics": [],
        "orderby": [
          [
            "component_name",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "What are the base layer values?",
      "output": {
        "columns": [
          "base_layer"
        ],
        "metrics": [
          {
            "label": "base_layer_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "groupby": [
          "base_layer"
        ],
        "row_limit": 30
      }
    },
    {
      "input": "What npm packages have non-permissive licenses?",
      "output": {
        "columns": [
          "component_name",
          "component_purl",
          "license_expression"
        ],
        "filters": [
          {
            "col": "component_purl",
            "op": "like",
            "val": "%pkg:npm%"
          },
          {
            "col": "license_expression",
            "op": "like",
            "val": "%GPL%"
          }
        ],
        "metrics": [],
        "orderby": [
          [
            "component_name",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "How many npm packages are in my products?",
      "output": {
        "columns": [],
        "filters": [
          {
            "col": "component_purl",
            "op": "like",
            "val": "%pkg:npm%"
          }
        ],
        "metrics": [
          {
            "label": "npm_component_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "orderby": [],
        "row_limit": 1
      }
    },
    {
      "input": "What are the high-level components of a product?",
      "output": {
        "columns": [
          "targetName"
        ],
        "filters": [
          {
            "col": "logical_app",
            "op": "==",
            "val": "Scribot"
          }
        ],
        "metrics": [],
        "orderby": [
          [
            "targetName",
            true
          ]
        ],
        "row_limit": 10
      }
    },
    {
      "input": "What are all the components that have the requests package?",
      "output": {
        "columns": [
          "targetName"
        ],
        "filters": [
          {
            "col": "component_name",
            "op": "==",
            "val": "requests"
          }
        ],
        "metrics": [],
        "orderby": [
          [
            "targetName",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "What are the labels in my products and components?",
      "output": {
        "columns": [
          "labels"
        ],
        "filters": [],
        "metrics": [],
        "orderby": [
          [
            "labels",
            true
          ]
        ],
        "row_limit": 30
      }
    }
  ],
  "query_vulnerabilities": [
    {
      "input": "Which components or modules in our software are most frequently associated with vulnerabilities?",
      "output": {
        "columns": [
          "logical_app",
          "logical_app_version",
          "version_timestamp",
          "component_name"
        ],
        "filters": [
          {
            "col": "is_latest_logical_version",
            "op": "==",
            "val": true
          }
        ],
        "metrics": [
          {
            "label": "vulnerability_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT()"
          }
        ],
        "orderby": [
          [
            "vulnerability_count",
            false
          ]
        ],
        "row_limit": 50
      }
    },
    {
      "input": "How many vulnerabilities that have a patch?",
      "output": {
        "columns": [
          "logical_app",
          "logical_app_version"
        ],
        "filters": [
          {
            "col": "is_latest_logical_version",
            "op": "==",
            "val": true
          },
          {
            "col": "has_fix",
            "op": "==",
            "val": true
          }
        ],
        "metrics": [
          {
            "label": "patchable_vulnerabilities",
            "expressionType": "SQL",
            "sqlExpression": "COUNT()"
          }
        ],
        "orderby": [
          [
            "unpatchable_vulnerabilities",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "Which package has most vulnerabilities that the vendor will not fix?",
      "output": {
        "columns": [
          "component_name",
          "component_version"
        ],
        "filters": [
          {
            "col": "is_latest_logical_version",
            "op": "==",
            "val": true
          },
          {
            "col": "will_not_fix",
            "op": "==",
            "val": true
          }
        ],
        "metrics": [
          {
            "label": "not_to_be_fixed_vulnerabilities",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "groupby": [
          "logical_app",
          "logical_app_version",
          "component_name"
        ],
        "orderby": [
          [
            "unpatchable_vulnerabilities",
            false
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "Which of my products have a KEV / exploitable vulnerability?",
      "output": {
        "columns": [
          "logical_app",
          "vulnerability_id"
        ],
        "filters": [
          {
            "col": "is_latest_logical_version",
            "op": "==",
            "val": true
          },
          {
            "col": "has_kev",
            "op": "==",
            "val": true
          }
        ],
        "metrics": [],
        "groupby": [],
        "orderby": [],
        "row_limit": 30
      }
    },
    {
      "input": "Which vulnerabilities affect the most of my products?",
      "output": {
        "columns": [
          "vulnerability_id",
          "final_severity"
        ],
        "filters": [
          {
            "col": "is_latest_logical_version",
            "op": "==",
            "val": true
          }
        ],
        "metrics": [
          {
            "label": "product_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(distinct logical_app)"
          }
        ],
        "groupby": [],
        "orderby": [
          [
            "final_severity",
            false
          ],
          [
            "product_count",
            false
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "Which vulnerabilities have an Attack Vector: Network (Can be exploited over the network)?",
      "output": {
        "columns": [
          "logical_app",
          "vulnerability_id",
          "vector"
        ],
        "filters": [
          {
            "col": "is_latest_logical_version",
            "op": "==",
            "val": true
          },
          {
            "col": "vector",
            "op": "like",
            "val": "%AV:N%"
          }
        ],
        "metrics": [],
        "groupby": [],
        "orderby": [],
        "row_limit": 30
      }
    }
  ],
  "query_risk": [
    {
      "input": "Which product versions have the highest total risk?",
      "output": {
        "columns": [
          "logical_app_version",
          "logical_app",
          "total_risk"
        ],
        "filters": [],
        "metrics": [],
        "groupby": [],
        "orderby": [
          [
            "total_risk",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "How many fixable CVEs exist in each component?",
      "output": {
        "columns": [
          "target"
        ],
        "filters": [],
        "metrics": [
          {
            "label": "fixable_cves",
            "expressionType": "SQL",
            "sqlExpression": "SUM(target_fixables)"
          }
        ],
        "groupby": [
          "target"
        ],
        "orderby": [
          [
            "fixable_cves",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "List the top 10 products by weighted CVE risk.",
      "output": {
        "columns": [
          "logical_app",
          "weighted_cve_risk"
        ],
        "filters": [],
        "metrics": [],
        "groupby": [],
        "orderby": [
          [
            "weighted_cve_risk",
            true
          ]
        ],
        "row_limit": 10
      }
    },
    {
      "input": "Show total exploitables grouped by product version.",
      "output": {
        "columns": [
          "logical_app_version"
        ],
        "filters": [],
        "metrics": [
          {
            "label": "exploitables",
            "expressionType": "SQL",
            "sqlExpression": "SUM(logical_app_version_exploitables)"
          }
        ],
        "groupby": [
          "logical_app_version"
        ],
        "orderby": [
          [
            "exploitables",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "Which components have KEVs and are in the base image?",
      "output": {
        "columns": [
          "target",
          "vulnerability_id"
        ],
        "filters": [
          {
            "col": "has_kev",
            "op": "==",
            "val": true
          },
          {
            "col": "in_base_image",
            "op": "==",
            "val": true
          }
        ],
        "metrics": [],
        "groupby": [],
        "orderby": [],
        "row_limit": 30
      }
    }
  ],
  "query_findings": [
    {
      "input": "What are the high-severity findings across all tools?",
      "output": {
        "columns": [
          "title",
          "severity_string",
          "main_tool",
          "logical_app"
        ],
        "filters": [
          {
            "col": "severity_string",
            "op": "in",
            "val": [
              "HIGH",
              "CRITICAL"
            ]
          }
        ],
        "metrics": [],
        "groupby": [],
        "orderby": [
          [
            "severity_string",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "How many findings exist for each product?",
      "output": {
        "columns": [
          "logical_app"
        ],
        "filters": [],
        "metrics": [
          {
            "label": "finding_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "groupby": [
          "logical_app"
        ],
        "orderby": [
          [
            "finding_count",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "Show me findings with a CVSS score above 7.",
      "output": {
        "columns": [
          "title",
          "cvssv3",
          "logical_app",
          "component_name"
        ],
        "filters": [
          {
            "col": "cvssv3",
            "op": ">",
            "val": "7"
          }
        ],
        "metrics": [],
        "groupby": [],
        "orderby": [],
        "row_limit": 30
      }
    },
    {
      "input": "Which tools produce the most findings?",
      "output": {
        "columns": [
          "main_tool"
        ],
        "filters": [],
        "metrics": [
          {
            "label": "total_findings",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "groupby": [
          "main_tool"
        ],
        "orderby": [
          [
            "total_findings",
            true
          ]
        ],
        "row_limit": 30
      }
    },
    {
      "input": "What types of CWEs are most commonly reported?",
      "output": {
        "columns": [
          "cwe_id"
        ],
        "filters": [],
        "metrics": [
          {
            "label": "cwe_count",
            "expressionType": "SQL",
            "sqlExpression": "COUNT(*)"
          }
        ],
        "groupby": [
          "cwe_id"
        ],
        "orderby": [
          [
            "cwe_count",
            true
          ]
        ],
        "row_limit": 30
      }
    }
  ]
}