Knowledge Graph & Inventory
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The Knowledge Graph & Inventory system within FixOps serves as the central intelligence repository that correlates diverse security signals, architectural designs, and business contexts. Its primary purpose is to transform flat security findings into a relational map of entities, enabling the platform to perform complex reachability analysis and impact assessments. By integrating Software Bill of Materials (SBOM) data, SARIF findings, and cloud-native application protection platform (CNAPP) exposures, the system provides a holistic view of the security posture.
The inventory component manages the lifecycle of applications and assets, providing the foundational metadata required for the Knowledge Graph. This unified data model supports the advanced decision engine by providing structured evidence for automated security gating and remediation workflows.
Architecture and Components
The architecture consists of a multi-layered processing approach that ingests raw data, normalizes it, and builds a directed graph of relationships between components, vulnerabilities, and business entities.
Knowledge Graph Service
The KnowledgeGraphService is responsible for assembling a CTINexus-compatible payload from various pipeline artifacts. It extracts service names, findings, and advisories to build a snapshot of the environment's security state.
The graph construction logic maps findings (from SARIF) and advisories (from CVE feeds) to specific service components based on crosswalk data. It also integrates compliance frameworks by creating "control" entities that relate to services via "satisfies" or "requires" edges.
Sources: apps/api/knowledge_graph.py:15-188, core/processing_layer.py:192-257
Inventory Management
The Inventory system tracks applications and assets through dedicated API endpoints. It supports application registration, asset discovery, and detailed listing of environment components.
| Component | Description | Sources |
|---|---|---|
| Applications | High-level entities representing software services (e.g., payment-gateway). | samples/api-examples/README.md:143-151 |
| Assets | Infrastructure components like EC2 instances or containers. | samples/api-examples/README.md:153-162 |
| SBOM Components | Software dependencies and libraries extracted from build artifacts. | core/processing_layer.py:202-212 |
| Cloud Assets | Cloud-native resources and their traits/exposures (CNAPP). | core/processing_layer.py:241-246 |
Data Ingestion and Normalization
Data enters the system through various ingestors that handle specific formats. The ProcessingLayer then consolidates these into a unified result structure.
Supported Ingestion Formats
The system supports several industry-standard security and architectural formats:
- SBOM: CycloneDX, SPDX, Syft JSON, and GitHub Dependency Snapshots.
- SARIF: Static analysis results from tools like SonarQube or Checkmarx.
- CVE/KEV: Vulnerability feeds for enrichment.
- CNAPP: Cloud security findings (AWS Security Hub, Azure Defender).
Sources: CLI_API_INVENTORY.md:108-132, samples/api-examples/README.md:47-90
Processing Flow
When artifacts are uploaded, the system executes a sequence of normalization and enrichment steps.
Advanced Analytics and Graph Metrics
The system uses graph theory to calculate risk and priority. When the networkx library is available, the processing layer computes specific topological metrics.
Graph Metrics
The system calculates the following metrics to evaluate the complexity and risk of the environment:
- Node Count: Total number of entities (components, findings, advisories).
- Edge Count: Total number of relationships (impacts, references, requirements).
- Density: The ratio of actual edges to possible edges.
- Degree Centrality: Identifies "hotspot" nodes that are highly connected, often indicating critical components or widespread vulnerabilities.
Sources: core/processing_layer.py:247-257, frontend/src/pages/ArchitectDashboard.jsx:266-281
Bayesian and Markov Integration
The Knowledge Graph is augmented by probabilistic modeling:
- Bayesian Inference: Computes risk priors based on exploitation, exposure, and mission impact.
- Markov Projections: Forecasts the potential evolution of vulnerability states across transitions.
Sources: core/processing_layer.py:94-173, frontend/src/pages/ArchitectDashboard.jsx:250-264
API Surface
The inventory and knowledge graph functionalities are exposed via the following primary endpoints:
| Endpoint | Method | Purpose |
|---|---|---|
/api/v1/inventory/applications | POST | Register a new application entity. |
/api/v1/inventory/assets/discover | POST | Submit discovered infrastructure assets. |
/api/v1/inventory/search | GET | Search through the asset and application inventory. |
/api/v1/decisions/core-components | GET | Retrieve status of graph and processing components. |
/api/v1/enhanced/capabilities | GET | List available graph and AI analysis capabilities. |
| Sources: samples/api-examples/README.md:143-162, CLI_API_INVENTORY.md:85, frontend/src/pages/ArchitectDashboard.jsx:24-30 |
Summary
The Knowledge Graph & Inventory system provides the structural foundation for FixOps by correlating disparate security artifacts into a meaningful relationship map. By combining inventory management with graph-based processing, the system enables the platform to transition from simple vulnerability lists to complex, context-aware security decisions. This architecture supports high-performance CI/CD gating while maintaining an immutable evidence trail for compliance and audit requirements.