<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-incident-knowledge-graphs
description: >-
  Build and query knowledge graphs that map relationships between
  incidents, threat actors, TTPs, affected systems, and remediation
  actions to enable pattern discovery and predictive analysis.
domain: cybersecurity
subdomain: incident-management
tags:
  - knowledge-graph
  - graph-database
  - threat-intelligence
  - pattern-analysis
  - neo4j
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0009", "TA0043"]
  nist-csf: ["RS.AN-3", "RS.AN-4", "ID.RA-2"]
  frameworks: ["STIX/TAXII", "MITRE ATT&CK", "UCO Ontology"]
---

# Building Incident Knowledge Graphs

## Overview

Incident knowledge graphs represent incidents, threat actors, TTPs,
indicators, and affected assets as interconnected nodes and relationships.
Graph analysis reveals patterns invisible in tabular data — attack path
commonalities, threat actor evolution, and systemic weaknesses across
the organization.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Graph database | Neo4j, Amazon Neptune, or TigerGraph |
| Incident data source | SIEM, ticketing, threat intel feeds |
| STIX/TAXII integration | Standardized threat intelligence format |
| Query interface | Cypher, Gremlin, or SPARQL |

## Key Concepts

### Graph Schema

```
NODE TYPES:
  (:Incident {id, severity, type, date, status})
  (:ThreatActor {name, aliases, motivation, sophistication})
  (:TTP {mitre_id, tactic, technique, description})
  (:Indicator {type, value, confidence, first_seen})
  (:Asset {hostname, type, criticality, business_unit})
  (:Vulnerability {cve_id, cvss, affected_product})

RELATIONSHIPS:
  (Incident)-[:ATTRIBUTED_TO]->(ThreatActor)
  (Incident)-[:USED_TTP]->(TTP)
  (Incident)-[:HAS_IOC]->(Indicator)
  (Incident)-[:AFFECTED]->(Asset)
  (Incident)-[:EXPLOITED]->(Vulnerability)
  (ThreatActor)-[:EMPLOYS]->(TTP)
  (TTP)-[:REQUIRES]->(Vulnerability)
  (Asset)-[:RUNS]->(Vulnerability)
```

### Cypher Query Examples

```cypher
// Find all TTPs used against critical assets
MATCH (i:Incident)-[:USED_TTP]->(t:TTP),
      (i)-[:AFFECTED]->(a:Asset {criticality: 'critical'})
RETURN t.mitre_id, t.technique, count(i) AS frequency
ORDER BY frequency DESC

// Discover attack path commonalities
MATCH path = (actor:ThreatActor)-[:ATTRIBUTED_TO]-(i:Incident)
             -[:USED_TTP]->(t:TTP)
RETURN actor.name, collect(DISTINCT t.mitre_id) AS ttp_set

// Find assets exposed to active threat actor TTPs
MATCH (actor:ThreatActor {name: 'APT29'})-[:EMPLOYS]->(t:TTP)
      -[:REQUIRES]->(v:Vulnerability)<-[:RUNS]-(a:Asset)
WHERE NOT EXISTS((a)<-[:PATCHED]-())
RETURN a.hostname, v.cve_id, t.mitre_id
```

### Knowledge Graph Layers

| Layer | Content | Update Frequency |
|-------|---------|-----------------|
| Strategic | Threat actor profiles, campaigns | Weekly |
| Tactical | TTPs, attack patterns | Per-incident |
| Operational | IOCs, infrastructure | Real-time |
| Asset | Systems, vulnerabilities, owners | Daily |

## Workflow

1. Design graph schema covering incident domain entities
2. Deploy graph database with appropriate indexing
3. Build ETL pipelines from incident data sources
4. Ingest historical incident data with relationships
5. Integrate real-time threat intelligence feeds
6. Develop query library for common analysis patterns
7. Build visualization dashboards for graph exploration

```bash
# Ingest incident data into knowledge graph
node agent.js ingest --incident-id INC-2026-0200 \
  --ttps '["T1566.001","T1059.001"]' --assets '["web-srv-01"]'

# Query attack patterns
node agent.js query-patterns --actor APT29

# Find exposed assets
node agent.js find-exposed --ttp T1190
```

## Verification

- [ ] Graph schema covers all entity types and relationships
- [ ] Historical incidents ingested with validated relationships
- [ ] Threat intelligence feeds updating in real-time
- [ ] Query library covers top 10 analysis patterns
- [ ] Visualization dashboard accessible to analysts

## References

- NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
- MITRE ATT&CK Framework — https://attack.mitre.org/
- STIX/TAXII
