Nobody05/security

1---2language:3- en4license: apache-2.05task_categories:6- graph-ml7tags:8- knowledge-graph9- cybersecurity10- mitre-attack11- capec12- cwe13- cve14- cpe15- d3fend16- atlas17- car18- engage19- f320- epss21- kev22- vulnrichment23- ghsa24- sigma25- exploitdb26- misp-galaxy27- lolbas28- loldrivers29- atomic-red-team30- nist-800-5331- nuclei32- euvd33- osv34- stix35- threat-intelligence36- triples37pretty_name: "Security Knowledge Graph Triples (ATT&CK / CAPEC / CWE / CVE / CPE / D3FEND / ATLAS / CAR / ENGAGE / F3 / EPSS / KEV / Vulnrichment / GHSA / Sigma / ExploitDB / MISP Galaxies / LOLBAS / LOLDrivers / Atomic Red Team / NIST 800-53 / Nuclei / EUVD / OSV)"38size_categories:39- 10M<n<100M40configs:41- config_name: enterprise42  data_files:43  - split: train44    path: data/enterprise.parquet45  default: true46- config_name: mobile47  data_files:48  - split: train49    path: data/mobile.parquet50- config_name: ics51  data_files:52  - split: train53    path: data/ics.parquet54- config_name: attack-all55  data_files:56  - split: train57    path: data/attack-all.parquet58- config_name: capec59  data_files:60  - split: train61    path: data/capec.parquet62- config_name: cwe63  data_files:64  - split: train65    path: data/cwe.parquet66- config_name: cve67  data_files:68  - split: train69    path: data/cve.parquet70- config_name: cpe71  data_files:72  - split: train73    path: data/cpe.parquet74- config_name: d3fend75  data_files:76  - split: train77    path: data/d3fend.parquet78- config_name: atlas79  data_files:80  - split: train81    path: data/atlas.parquet82- config_name: car83  data_files:84  - split: train85    path: data/car.parquet86- config_name: engage87  data_files:88  - split: train89    path: data/engage.parquet90- config_name: f391  data_files:92  - split: train93    path: data/f3.parquet94- config_name: epss95  data_files:96  - split: train97    path: data/epss.parquet98- config_name: kev99  data_files:100  - split: train101    path: data/kev.parquet102- config_name: vulnrichment103  data_files:104  - split: train105    path: data/vulnrichment.parquet106- config_name: ghsa107  data_files:108  - split: train109    path: data/ghsa.parquet110- config_name: sigma111  data_files:112  - split: train113    path: data/sigma.parquet114- config_name: exploitdb115  data_files:116  - split: train117    path: data/exploitdb.parquet118- config_name: misp_galaxy119  data_files:120  - split: train121    path: data/misp_galaxy.parquet122- config_name: lolbas123  data_files:124  - split: train125    path: data/lolbas.parquet126- config_name: loldrivers127  data_files:128  - split: train129    path: data/loldrivers.parquet130- config_name: atomic131  data_files:132  - split: train133    path: data/atomic.parquet134- config_name: nist_800_53135  data_files:136  - split: train137    path: data/nist_800_53.parquet138- config_name: nuclei139  data_files:140  - split: train141    path: data/nuclei.parquet142- config_name: euvd143  data_files:144  - split: train145    path: data/euvd.parquet146- config_name: osv147  data_files:148  - split: train149    path: data/osv.parquet150- config_name: combined151  data_files:152  - split: train153    path: data/combined.parquet154dataset_info:155  features:156  - name: subject157    dtype: string158  - name: predicate159    dtype: string160  - name: object161    dtype: string162  - name: source163    dtype: string164  - name: object_type165    dtype: string166  - name: meta167    dtype: string168---169 170# Security Knowledge Graph Triples171 172Security data from 24 sources represented as **Subject-Predicate-Object (SPO) triples** in Parquet format, ready for knowledge-graph construction, graph-ML, RAG pipelines, and threat-intelligence analysis.173 174Sources: [ATT&CK](https://attack.mitre.org/) · [CAPEC](https://capec.mitre.org/) · [CWE](https://cwe.mitre.org/) · [CVE](https://www.cve.org/) · [CPE](https://nvd.nist.gov/products/cpe) · [D3FEND](https://d3fend.mitre.org/) · [ATLAS](https://atlas.mitre.org/) · [CAR](https://car.mitre.org/) · [ENGAGE](https://engage.mitre.org/) · [F3](https://ctid.mitre.org/fraud) · [EPSS](https://www.first.org/epss/) · [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [Vulnrichment](https://github.com/cisagov/vulnrichment) · [GHSA](https://github.com/github/advisory-database) · [Sigma](https://github.com/SigmaHQ/sigma) · [ExploitDB](https://gitlab.com/exploit-database/exploitdb) · [MISP Galaxies](https://github.com/MISP/misp-galaxy) · [LOLBAS](https://lolbas-project.github.io/) · [LOLDrivers](https://www.loldrivers.io/) · [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) · [NIST 800-53](https://github.com/center-for-threat-informed-defense/mappings-explorer) · [Nuclei](https://github.com/projectdiscovery/nuclei-templates) · [EUVD](https://euvd.enisa.europa.eu/) · [OSV](https://osv.dev/)175 176*Last updated: 2026-07-13T09:12:52Z*177 178## Quick Start179 180```python181from datasets import load_dataset182 183ds = load_dataset("s0u9ata/security-kg", "enterprise")184print(ds["train"][0])185# {'subject': 'T1059.001', 'predicate': 'rdf:type', 'object': 'Technique', 'source': 'attack', 'object_type': 'enum', 'meta': ''}186```187 188## Configurations189 190| Config | Description | Est. Triples | Status |191|--------|-------------|-------------|--------|192| `enterprise` (default) | Enterprise ATT&CK | 43,739 | Current |193| `mobile` | Mobile ATT&CK | 5,579 | Current |194| `ics` | ICS ATT&CK | 4,266 | Current |195| `attack-all` | ATT&CK combined (deduplicated) | 51,907 | Current |196| `capec` | CAPEC attack patterns | 8,114 | Current |197| `cwe` | CWE weaknesses | 14,583 | Current |198| `cve` | CVE vulnerabilities | 3,875,509 | Current |199| `cpe` | CPE platform enumeration | 13,545,566 | Last good version |200| `d3fend` | D3FEND defensive techniques | 8,154 | Current |201| `atlas` | ATLAS AI/ML techniques | 1,373 | Current |202| `car` | CAR analytics | 1,617 | Current |203| `engage` | ENGAGE adversary engagement | 1,464 | Current |204| `f3` | F3 fraud techniques & tactics | 1,053 | Current |205| `epss` | EPSS exploit prediction scores | 694,384 | Current |206| `kev` | KEV known exploited vulns | 17,938 | Current |207| `vulnrichment` | CISA Vulnrichment (SSVC, CVSS, CWE enrichment) | 1,549,549 | Current |208| `ghsa` | GitHub Security Advisories | 382,938 | Current |209| `sigma` | Sigma detection rules | 33,498 | Current |210| `exploitdb` | ExploitDB public exploits | 347,263 | Current |211| `misp_galaxy` | MISP Galaxy threat intelligence clusters | 203,459 | Current |212| `lolbas` | LOLBAS living-off-the-land binaries | 3,692 | Current |213| `loldrivers` | LOLDrivers vulnerable/malicious drivers | 11,738 | Current |214| `atomic` | Atomic Red Team test definitions | 11,024 | Current |215| `nist_800_53` | NIST 800-53 → ATT&CK control mappings | 4,786 | Current |216| `nuclei` | Nuclei vulnerability detection templates | 98,515 | Current |217| `euvd` | EUVD European vulnerability database | 4,923 | Current |218| `osv` | OSV open-source vulnerabilities (23 ecosystems) | 7,202,861 | Current |219| `combined` | All sources merged (deduplicated) | 28,075,908 | Current |220 221 222 223 224<!-- fallback-status-note -->225> **Note:** `cpe` failed conversion and uses its last known good version. The `combined` config includes this fallback version.226 227## Knowledge Graph Structure228 229```230     Group  Campaign231        \      /232          uses233           |234           v235      TECHNIQUE -----> Tactic236        ^  ^  ^237        |  |  |238        |  |  +-- D3FEND (counters)239        |  |  +-- CAR (detects)240        |  |  +-- Sigma (detects)241        |  |  +-- ENGAGE (engages)242        |  |  +-- F3 (fraud techniques)243        |  |  +-- ATLAS (related)244        |  |  +-- MISP Galaxies (cross-refs)245        |  |  +-- LOLBAS (maps-to)246        |  |  +-- LOLDrivers (maps-to)247        |  |  +-- Atomic Red Team (tests)248        |  |  +-- NIST 800-53 (mitigates)249        |  |250        |  +-- Mitigation (mitigates)251        |  +-- DataComponent (detects)252        |253        +-- maps-to -- CAPEC254                         |255                  related-weakness256                         |257                         v258                        CWE259                         ^260                         |261                  related-weakness262                         |263                        CVE ----> CPE264                         ^265                         |266                   EPSS (score)267                   KEV (exploited)268                   GHSA (advisory)269                   Vulnrichment (SSVC)270                   ExploitDB (exploit)271                   Nuclei (detection template)272                   EUVD (EU advisory)273                   OSV (open-source vuln)274```275 276## Schema277 278Each row is an enriched triple with six string columns:279 280| Column | Description | Examples |281|--------|-------------|----------|282| `subject` | Entity ID | `T1059.001`, `G0016`, `CAPEC-66`, `CWE-79`, `CVE-2024-1234`, `cpe:2.3:a:apache:httpd:*`, `D3-FE`, `AML.T0000`, `CAR-2024-01-001`, `EAC0001`, `GHSA-xxxx-yyyy-zzzz`, `EDB-16929`, `Msbuild.exe`, `EUVD-2025-4893`, `AC-2`, `PYSEC-2024-1234` |283| `predicate` | Property name or relationship type | `rdf:type`, `name`, `uses`, `mitigates`, `epss-score`, `counters`, `ssvc-exploitation`, `exploits-cve`, `detects-technique` |284| `object` | Value or target entity ID | `Technique`, `PowerShell`, `T1059`, `CWE-89`, `0.97500`, `SecurityAdvisory`, `SigmaRule`, `Exploit` |285| `source` | Originating dataset | `attack`, `cve`, `cwe`, `capec`, `epss`, `kev`, `ghsa`, `sigma`, `d3fend`, `atlas`, `car`, `engage`, `f3`, `cpe`, `vulnrichment`, `exploitdb`, `misp_galaxy`, `lolbas`, `loldrivers`, `atomic`, `nist_800_53`, `nuclei`, `euvd`, `osv` |286| `object_type` | Value type of the object | `string`, `id`, `enum`, `date`, `number`, `boolean`, `url` |287| `meta` | Supplemental JSON metadata (empty string if none) | `{"references":["https://..."],"credits":[...]}`, `{"cvss_vector":"...","cvss_version":"3.1"}` |288 289## Predicate Reference290 291### ATT&CK Entity Properties292 293| Predicate | Description | Example object value |294|-----------|-------------|---------------------|295| `rdf:type` | Entity type | `Technique`, `Group`, `Malware`, `Tool`, `Tactic`, `Mitigation`, `Campaign`, `DataSource`, `DataComponent` |296| `name` | Display name | `PowerShell` |297| `description` | Full description text | `Adversaries may abuse PowerShell...` |298| `platform` | Applicable platform | `Windows`, `Linux`, `macOS` |299| `domain` | ATT&CK domain | `enterprise-attack` |300| `alias` | Alternative name | `Cozy Bear` |301| `is-subtechnique` | Whether entity is a sub-technique | `True`, `False` |302| `belongs-to-tactic` | Tactic ATT&CK ID | `TA0002` |303| `shortname` | Tactic shortname | `credential-access` |304| `url` | ATT&CK website URL | `https://attack.mitre.org/techniques/T1059/001` |305| `created` / `modified` | Timestamps | `2020-01-14 17:18:32...` |306 307### ATT&CK Relationship Predicates308 309| Predicate | Typical subject / object | Example |310|-----------|--------------------------|---------|311| `uses` | Group/Campaign/Software / Technique | `G0016 / T1059.001` |312| `mitigates` | Mitigation / Technique | `M1049 / T1059.001` |313| `subtechnique-of` | Sub-technique / Parent technique | `T1059.001 / T1059` |314| `detects` | DataComponent / Technique | `DC0001 / T1059.001` |315| `attributed-to` | Campaign / Group | `C0018 / G0016` |316 317### CAPEC Predicates318 319| Predicate | Description | Example object value |320|-----------|-------------|---------------------|321| `rdf:type` | `AttackPattern` | `AttackPattern` |322| `name` / `description` | Display name / full text | `SQL Injection` |323| `abstraction` / `status` | Level / status | `Standard`, `Stable` |324| `likelihood` / `severity` | Attack likelihood / severity | `High` |325| `child-of` | Parent attack pattern | `CAPEC-248` |326| `related-weakness` | Related CWE | `CWE-89` |327| `maps-to-technique` | Mapped ATT&CK technique | `T1190.002` |328 329### CWE Predicates330 331| Predicate | Description | Example object value |332|-----------|-------------|---------------------|333| `rdf:type` | `Weakness` | `Weakness` |334| `name` / `description` | Display name / full text | `Cross-site Scripting (XSS)` |335| `abstraction` / `status` | Level / status | `Base`, `Stable` |336| `likelihood-of-exploit` | Exploitation likelihood | `High` |337| `child-of` | Parent weakness | `CWE-74` |338| `related-attack-pattern` | Related CAPEC | `CAPEC-86` |339| `platform` | Applicable platform | `JavaScript` |340| `consequence-scope` / `consequence-impact` | Impact | `Confidentiality`, `Read Data` |341| `introduction-phase` | Introduction phase | `Implementation` |342 343### CVE Predicates344 345| Predicate | Description | Example object value |346|-----------|-------------|---------------------|347| `rdf:type` | `Vulnerability` | `Vulnerability` |348| `state` | CVE state | `PUBLISHED` |349| `description` | English description | `A remote code execution...` |350| `date-published` / `date-updated` | Timestamps | `2024-01-15T00:00:00.000Z` |351| `assigner` | Assigning organization | `microsoft` |352| `vendor` / `product` | Affected vendor/product | `Microsoft`, `Windows` |353| `affects-cpe` | Affected CPE string | `cpe:2.3:o:microsoft:windows_10:*` |354| `platform` | Affected platform | `x64` |355| `related-weakness` | Related CWE | `CWE-79` |356| `cvss-base-score` / `cvss-severity` | CVSS metrics | `9.8`, `CRITICAL` |357 358### CPE Predicates359 360| Predicate | Description | Example object value |361|-----------|-------------|---------------------|362| `rdf:type` | `Platform` | `Platform` |363| `part` | CPE part type | `application`, `operating_system`, `hardware` |364| `vendor` / `product` / `version` | Components | `apache`, `httpd`, `2.4.51` |365| `title` | English display name | `Apache HTTP Server 2.4.51` |366| `created` / `modified` | Timestamps | `2021-10-07` |367 368### D3FEND Predicates369 370| Predicate | Description | Example object value |371|-----------|-------------|---------------------|372| `rdf:type` | `DefensiveTechnique` or `OffensiveTechnique` | `DefensiveTechnique` |373| `name` / `definition` | Display name / definition | `File Encryption` |374| `synonym` | Alternative name | `Disk Encryption` |375| `child-of` | Parent technique | `PlatformHardening` |376| `counters` | Countered offensive technique | `T1059` |377 378### ATLAS Predicates379 380| Predicate | Description | Example object value |381|-----------|-------------|---------------------|382| `rdf:type` | `Tactic`, `Technique`, `CaseStudy`, `Mitigation` | `Technique` |383| `name` / `description` | Display name / full text | `ML Supply Chain Compromise` |384| `maturity` | Technique maturity | `Reviewed` |385| `belongs-to-tactic` | Parent tactic | `AML.TA0001` |386| `subtechnique-of` | Parent technique | `AML.T0000` |387| `related-attack-technique` | Linked ATT&CK technique | `T1195` |388| `related-attack-tactic` | Linked ATT&CK tactic | `TA0001` |389| `uses-technique` | Case study technique | `AML.T0000` |390| `mitigates` | Mitigated technique | `AML.T0000` |391 392### CAR Predicates393 394| Predicate | Description | Example object value |395|-----------|-------------|---------------------|396| `rdf:type` | `Analytic` | `Analytic` |397| `title` / `description` | Analytic name / full text | `Suspicious PowerShell Commands` |398| `platform` | Applicable platform | `Windows` |399| `information-domain` | Information domain | `Host` |400| `analytic-type` | Type of analytic | `Situational Awareness` |401| `detects-technique` | Detected ATT&CK technique | `T1059` |402| `detects-subtechnique` | Detected subtechnique | `T1059.001` |403| `covers-tactic` | Covered ATT&CK tactic | `Execution` |404| `maps-to-d3fend` | Linked D3FEND technique | `D3-PSA` |405 406### ENGAGE Predicates407 408| Predicate | Description | Example object value |409|-----------|-------------|---------------------|410| `rdf:type` | `EngagementActivity` or `AdversaryVulnerability` | `EngagementActivity` |411| `name` / `description` | Display name / full text | `Software Manipulation` |412| `engages-technique` | Engaged ATT&CK technique | `T1001` |413| `vulnerability-of` | ATT&CK technique this adversary vulnerability applies to | `T1001` |414| `addresses-vulnerability` | Addressed adversary vulnerability | `EAV0001` |415 416### F3 Predicates417 418| Predicate | Description | Example object value |419|-----------|-------------|---------------------|420| `rdf:type` | `Tactic` or `Technique` | `Technique` |421| `name` / `description` | Display name / full text | `Account Takeover` |422| `shortname` | Tactic shortname | `positioning`, `monetization` |423| `is-subtechnique` | Whether entity is a sub-technique | `true` |424| `belongs-to-tactic` | Parent tactic | `FA0001` |425| `subtechnique-of` | Parent technique | `F1001` |426| `url` | F3 website URL | `https://ctid.mitre.org/fraud/techniques/F1001` |427| `created` / `modified` | Timestamps | `2026-04-02T19:15:57.686Z` |428 429### EPSS Predicates430 431| Predicate | Description | Example object value |432|-----------|-------------|---------------------|433| `epss-score` | Exploit probability (0-1) | `0.97500` |434| `epss-percentile` | Score percentile (0-1) | `0.99900` |435 436### KEV Predicates437 438| Predicate | Description | Example object value |439|-----------|-------------|---------------------|440| `rdf:type` | `KnownExploitedVulnerability` | `KnownExploitedVulnerability` |441| `kev-vendor` / `kev-product` | Affected vendor/product | `Microsoft`, `Windows` |442| `kev-name` / `kev-description` | Vulnerability name/description | `Windows Privilege Escalation` |443| `kev-date-added` / `kev-due-date` | Dates | `2024-01-15` |444| `kev-required-action` | Required remediation action | `Apply updates per vendor instructions.` |445| `kev-ransomware-use` | Ransomware campaign use | `Known`, `Unknown` |446| `related-weakness` | Related CWE | `CWE-269` |447 448### Vulnrichment Predicates449 450| Predicate | Description | Example object value |451|-----------|-------------|---------------------|452| `ssvc-exploitation` | SSVC exploitation status | `active`, `poc`, `none` |453| `ssvc-automatable` | Whether exploitation is automatable | `yes`, `no` |454| `ssvc-technical-impact` | Technical impact level | `total`, `partial` |455| `adp-cvss-base-score` | CISA-analyzed CVSS base score | `9.8` |456| `adp-cvss-severity` | CISA-analyzed CVSS severity | `CRITICAL` |457| `adp-related-weakness` | CISA-assigned CWE | `CWE-79` |458| `adp-affects-cpe` | CISA-assigned CPE | `cpe:2.3:o:microsoft:windows_10:*` |459 460### GHSA Predicates461 462| Predicate | Description | Example object value |463|-----------|-------------|---------------------|464| `rdf:type` | `SecurityAdvisory` | `SecurityAdvisory` |465| `summary` | Advisory summary | `XSS vulnerability in example-package` |466| `date-published` / `date-modified` | Timestamps | `2024-01-15T00:00:00Z` |467| `severity` | Severity level | `HIGH`, `MODERATE`, `LOW`, `CRITICAL` |468| `related-cve` | Associated CVE | `CVE-2024-1234` |469| `related-weakness` | Associated CWE | `CWE-79` |470| `cvss-vector` | CVSS v3 vector string | `CVSS:3.1/AV:N/AC:L/...` |471| `affects-package` | Affected package (ecosystem/name) | `npm/example-package` |472| `fixed-in` | Fixed version for package (ecosystem/name@version) | `npm/example-package@2.0.1` |473 474### Sigma Predicates475 476| Predicate | Description | Example object value |477|-----------|-------------|---------------------|478| `rdf:type` | `SigmaRule` | `SigmaRule` |479| `title` / `description` | Rule name / full text | `Suspicious PowerShell Download` |480| `status` | Rule maturity | `stable`, `test`, `experimental` |481| `level` | Detection severity | `critical`, `high`, `medium`, `low`, `informational` |482| `author` / `date` | Rule author / creation date | `Security Researcher`, `2024-01-15` |483| `logsource-category` | Log source category | `process_creation`, `network_connection` |484| `logsource-product` | Log source product | `windows`, `linux` |485| `logsource-service` | Log source service | `sshd`, `sysmon` |486| `detects-technique` | Detected ATT&CK technique | `T1059.001` |487| `related-cve` | Related CVE | `CVE-2024-1234` |488 489### ExploitDB Predicates490 491| Predicate | Description | Example object value |492|-----------|-------------|---------------------|493| `rdf:type` | `Exploit` | `Exploit` |494| `description` | Exploit description | `Apache HTTP Server RCE` |495| `date-published` | Publication date | `2024-01-15` |496| `author` | Exploit author | `Metasploit` |497| `exploit-type` | Exploit category | `remote`, `local`, `dos`, `webapps` |498| `platform` | Target platform | `linux`, `windows`, `aix` |499| `verified` | Verified by OffSec | `True` |500| `exploits-cve` | Exploited CVE | `CVE-2024-1234` |501 502### MISP Galaxy Predicates503 504| Predicate | Description | Example object value |505|-----------|-------------|---------------------|506| `rdf:type` | Galaxy entity type | `ThreatActor`, `Ransomware`, `Botnet`, `RAT` |507| `name` | Display name | `APT1` |508| `description` | Full description | (text) |509| `galaxy` | Galaxy cluster type | `threat-actor`, `ransomware` |510| `synonym` | Alternative name | `Comment Crew` |511| `country` | Country code (ISO 3166-1) | `CN` |512| `cfr-suspected-state-sponsor` | Suspected state sponsor | `China` |513| `targets-country` | Targeted country | `United States` |514| `targets-sector` | Targeted sector | `Government` |515| `attribution-confidence` | Confidence level | `50` |516| `similar-to` | Similar/duplicate entity | `misp:<uuid>` |517| `uses` | Uses technique/tool | `misp:<uuid>` |518| `used-by` | Used by actor | `misp:<uuid>` |519| `variant-of` | Variant relationship | `misp:<uuid>` |520| `targets` | Targets entity | `misp:<uuid>` |521| `attributed-to` | Attributed to entity | `misp:<uuid>` |522| `misp-related` | Generic relationship | `misp:<uuid>` |523| `related-attack-id` | Cross-link to ATT&CK | `T1059.001`, `G0006` |524 525### LOLBAS Predicates526 527| Predicate | Description | Example object value |528|-----------|-------------|---------------------|529| `rdf:type` | `LOLBinary` | `LOLBinary` |530| `name` | Binary display name | `Msbuild.exe` |531| `description` | Binary description | `Used to compile and execute code` |532| `maps-to-technique` | Mapped ATT&CK technique | `T1127.001` |533| `category` | Use category | `Execute`, `Download` |534| `usecase` | Use case description | `Compile and run code` |535| `privileges` | Required privileges | `User` |536| `platform` | Target platform | `Windows` |537| `full-path` | File system path | `C:\Windows\Microsoft.NET\...` |538 539### LOLDrivers Predicates540 541| Predicate | Description | Example object value |542|-----------|-------------|---------------------|543| `rdf:type` | `LOLDriver` | `LOLDriver` |544| `name` | Driver name | `RTCore64.sys` |545| `category` | Driver category | `vulnerable driver`, `malicious driver` |546| `maps-to-technique` | Mapped ATT&CK technique | `T1068` |547| `usecase` | Use case description | `Exploits` |548| `privileges` | Required privileges | `kernel` |549| `platform` | Target platform | `Windows` |550| `sha256` / `sha1` / `md5` | Sample hashes | `01...af` |551| `vendor` / `product` | Driver vendor/product | `Micro-Star Int'l Co.`, `RTCore64` |552 553### Atomic Red Team Predicates554 555| Predicate | Description | Example object value |556|-----------|-------------|---------------------|557| `rdf:type` | `AtomicTest` | `AtomicTest` |558| `name` | Test name | `Mimikatz - Cred Dump` |559| `description` | Test description | `Runs Mimikatz to dump credentials` |560| `tests-technique` | Tested ATT&CK technique | `T1003.001` |561| `platform` | Supported platform | `windows`, `linux`, `macos` |562| `executor` | Execution method | `powershell`, `sh`, `command_prompt` |563 564### NIST 800-53 Predicates565 566| Predicate | Description | Example object value |567|-----------|-------------|---------------------|568| `rdf:type` | `SecurityControl` | `SecurityControl` |569| `name` | Control name | `Account Management` |570| `description` | Control description | `Manage system accounts...` |571| `control-family` | Control family | `AC`, `SI`, `AU` |572| `mitigates-technique` | Mitigated ATT&CK technique | `T1078` |573 574### Nuclei Predicates575 576| Predicate | Description | Example object value |577|-----------|-------------|---------------------|578| `rdf:type` | `NucleiTemplate` | `NucleiTemplate` |579| `name` | Template name | `Apache Struts2 RCE` |580| `description` | Template description | `Detects Apache Struts2 RCE...` |581| `severity` | Detection severity | `critical`, `high`, `medium`, `low`, `info` |582| `author` | Template author | `pdteam` |583| `related-weakness` | Related CWE | `CWE-94` |584| `related-cve` | Related CVE | `CVE-2023-1234` |585| `cvss-base-score` | CVSS base score | `9.8` |586| `cvss-vector` | CVSS vector string | `CVSS:3.1/AV:N/AC:L/...` |587 588### EUVD Predicates589 590| Predicate | Description | Example object value |591|-----------|-------------|---------------------|592| `rdf:type` | `EUVulnerability` | `EUVulnerability` |593| `description` | Vulnerability description | `A remote code execution...` |594| `date-published` | Publication date | `2025-01-15` |595| `cvss-base-score` | CVSS base score | `9.8` |596| `cvss-vector` | CVSS vector string | `CVSS:3.1/AV:N/AC:L/...` |597| `epss-score` | EPSS score | `0.95` |598| `related-cve` | Related CVE | `CVE-2025-1234` |599| `vendor` / `product` | Affected vendor/product | `Apache`, `HTTP Server` |600 601### OSV Predicates602 603| Predicate | Description | Example object value |604|-----------|-------------|---------------------|605| `rdf:type` | `OSVulnerability` | `OSVulnerability` |606| `summary` | Vulnerability summary | `XSS in example-package` |607| `date-published` / `date-modified` | Timestamps | `2024-01-15T00:00:00Z` |608| `related-cve` | Related CVE | `CVE-2024-1234` |609| `related-weakness` | Related CWE | `CWE-79` |610| `affects-package` | Affected package (ecosystem/name) | `PyPI/requests` |611| `ecosystem` | Package ecosystem | `PyPI`, `npm`, `Go`, `crates.io` |612| `cvss-vector` | CVSS vector string | `CVSS:3.1/AV:N/AC:L/...` |613 614## Dataset Creation615 616### Source Data617 618| Source | Feed | Format |619|--------|------|--------|620| ATT&CK | [`mitre-attack/attack-stix-data`](https://github.com/mitre-attack/attack-stix-data) | STIX 2.0 JSON |621| CAPEC | [`capec_latest.xml`](https://capec.mitre.org/data/xml/capec_latest.xml) | XML |622| CWE | [`cwec_latest.xml.zip`](https://cwe.mitre.org/data/xml/cwec_latest.xml.zip) | XML (ZIP) |623| CVE | [`CVEProject/cvelistV5`](https://github.com/CVEProject/cvelistV5/releases) | JSON 5.x (ZIP) |624| CPE | [`nvdcpe-2.0.tar.gz`](https://nvd.nist.gov/feeds/json/cpe/2.0/nvdcpe-2.0.tar.gz) | JSON (tar.gz) |625| D3FEND | [`d3fend.json`](https://d3fend.mitre.org/ontologies/d3fend.json) | JSON-LD |626| ATLAS | [`ATLAS.yaml`](https://raw.githubusercontent.com/mitre-atlas/atlas-data/main/dist/ATLAS.yaml) | YAML |627| CAR | [`mitre-attack/car`](https://github.com/mitre-attack/car) | YAML (ZIP) |628| ENGAGE | [`attack_mapping.json`](https://raw.githubusercontent.com/mitre/engage/main/Data/json/attack_mapping.json) | JSON |629| F3 | [`fight-fraud-framework`](https://github.com/center-for-threat-informed-defense/fight-fraud-framework) | STIX 2.1 JSON |630| EPSS | [`epss_scores-current.csv.gz`](https://epss.cyentia.com/epss_scores-current.csv.gz) | CSV (gzip) |631| KEV | [`known_exploited_vulnerabilities.json`](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) | JSON |632| Vulnrichment | [`cisagov/vulnrichment`](https://github.com/cisagov/vulnrichment) | JSON 5.x (ZIP) |633| GHSA | [`github/advisory-database`](https://github.com/github/advisory-database) | OSV JSON (ZIP) |634| Sigma | [`SigmaHQ/sigma`](https://github.com/SigmaHQ/sigma/releases) | YAML (ZIP) |635| ExploitDB | [`files_exploits.csv`](https://gitlab.com/exploit-database/exploitdb/-/raw/main/files_exploits.csv) | CSV |636| MISP Galaxies | [`MISP/misp-galaxy`](https://github.com/MISP/misp-galaxy) | JSON (ZIP) |637| LOLBAS | [`LOLBAS-Project/LOLBAS`](https://github.com/LOLBAS-Project/LOLBAS) | YAML (ZIP) |638| LOLDrivers | [`magicsword-io/LOLDrivers`](https://github.com/magicsword-io/LOLDrivers) | YAML (ZIP) |639| Atomic Red Team | [`redcanaryco/atomic-red-team`](https://github.com/redcanaryco/atomic-red-team) | YAML (ZIP) |640| NIST 800-53 | [`mappings-explorer`](https://github.com/center-for-threat-informed-defense/mappings-explorer) | JSON (ZIP) |641| Nuclei | [`projectdiscovery/nuclei-templates`](https://github.com/projectdiscovery/nuclei-templates) | YAML (ZIP) |642| EUVD | [`euvdservices.enisa.europa.eu`](https://euvdservices.enisa.europa.eu/api/kev/dump) | JSON |643| OSV | [`osv.dev`](https://osv.dev/) | JSON (per-ecosystem ZIPs) |644 645### Conversion Pipeline646 647The converter downloads source data, extracts entity property triples and relationship triples, and writes them as Parquet files. The source code and full documentation are at:648 649**[github.com/S0UGATA/security-kg](https://github.com/S0UGATA/security-kg)**650 651To regenerate or update this dataset:652 653```bash654git clone https://github.com/S0UGATA/security-kg.git655cd security-kg656pip install -r requirements.txt657python src/convert.py658```659 660This produces fresh Parquet files in `output/` from the latest data across all 24 sources.661 662## Visualizer663 664Explore the Parquet files interactively at [security-kg-viz](https://s0ugata.github.io/security-kg-viz/).665 666### Pre-computed neighborhoods (`neighborhoods/`)667 668For the most-connected entities in `combined.parquet`, this dataset ships669pre-rendered multi-hop neighborhood JSONs the visualizer can fetch directly,670skipping the DuckDB-WASM + Parquet path entirely for hot lookups:671 672```673neighborhoods/674  T1059.json              # array of Triple objects (depth=2, limit=500)675  T1059.001.json676  CVE-2024-1234.json677  CAPEC-100.json678  ...679  index.json              # { source, fingerprint, depth, limit, entities: [...] }680```681 682Each `<entity>.json` is the same shape the viz already builds from683`q.entityNeighborhood()` — an array of `{subject, predicate, object, source,684object_type, object_canonical}`. Filenames use a reversible slug (characters685outside `[A-Za-z0-9._-]` are `_xx` hex-escaped); `index.json` is the686authoritative mapping from entity → filename and includes a parquet687fingerprint for cache invalidation. The bundle is regenerated each weekly688refresh whenever `combined.parquet` changes.689 690## Use Cases691 692- **Knowledge Graph Construction**: Load triples into Neo4j, RDFLib, or NetworkX for graph queries693- **Graph ML**: Train graph neural networks (GNNs) on security data structure for link prediction694- **RAG / LLM Grounding**: Use triples as structured context for retrieval-augmented generation695- **Threat Intelligence**: Query relationships between groups, techniques, vulnerabilities, and mitigations696- **Vulnerability Prioritization**: Combine SSVC, EPSS, KEV, and ExploitDB data for risk-based triage697- **Defensive Gap Analysis**: Find heavily-used ATT&CK techniques with insufficient detection coverage698- **Supply Chain Risk**: Score open-source packages by linking GHSA advisories to CVE/EPSS/KEV enrichment699- **Security Automation**: Programmatically map detections to techniques to tactics700 701## Cross-Source Analysis Notebook702 703The repository includes a [Jupyter notebook](https://github.com/S0UGATA/security-kg/blob/main/examples/cross_source_visualizations.ipynb) with 16 cross-source analyses and visualizations built on `combined.parquet` — covering SSVC patch prioritization, defensive gap analysis, kill chain tactic coverage, exploit weaponization timelines, ransomware CWE pipelines, supply chain package risk, and more.704 705## Example Queries706 707### SSVC Patch Prioritization (Vulnrichment + EPSS + KEV)708 709```python710import pandas as pd711from datasets import load_dataset712 713# Load combined graph for cross-source queries714ds = load_dataset("s0u9ata/security-kg", "combined")715df = ds["train"].to_pandas()716 717# Build SSVC triage matrix: exploitation status × automatable × EPSS score718ssvc = df[df.predicate == "ssvc-exploitation"][["subject", "object"]].rename(columns={"object": "exploitation"})719auto = df[df.predicate == "ssvc-automatable"][["subject", "object"]].rename(columns={"object": "automatable"})720epss = df[df.predicate == "epss-score"][["subject", "object"]].copy()721epss["epss"] = epss.object.astype(float)722 723triage = ssvc.merge(auto, on="subject").merge(epss[["subject", "epss"]], on="subject")724 725# Highest priority: actively exploited + automatable + high EPSS726critical = triage[(triage.exploitation == "active") & (triage.automatable == "yes") & (triage.epss > 0.9)]727print(f"Immediate action: {len(critical)} CVEs")728```729 730### Defensive Gap Analysis (ATT&CK + Sigma + D3FEND + CAR)731 732```python733# Find ATT&CK techniques heavily used by APT groups but poorly covered by detections734uses = df[(df.predicate == "uses") & df.subject.str.startswith("G")]735group_usage = uses.groupby("object").subject.nunique().rename("groups_using")736 737# Count detection sources per technique (Sigma + CAR + D3FEND + ENGAGE)738sigma = df[df.predicate == "detects-technique"].groupby("object").subject.nunique().rename("detections")739d3fend = df[df.predicate == "restricts"].groupby("object").subject.nunique().rename("defenses")740 741coverage = pd.DataFrame(group_usage).join(sigma).join(d3fend).fillna(0)742gaps = coverage[(coverage.groups_using > 10) & (coverage.detections < 5)]743print(f"High-usage, low-detection techniques: {len(gaps)}")744```745 746### Supply Chain Risk (GHSA + CVE + EPSS + KEV + ExploitDB)747 748```python749# Score open-source packages by aggregating risk from linked CVEs750ghsa_cve = df[df.predicate == "related-cve"][["subject", "object"]].rename(columns={"subject": "ghsa", "object": "cve"})751packages = df[df.predicate == "affects-package"][["subject", "object"]].rename(columns={"subject": "ghsa", "object": "pkg"})752 753epss_scores = df[df.predicate == "epss-score"][["subject", "object"]].copy()754epss_scores["epss"] = epss_scores.object.astype(float)755 756kev_cves = set(df[(df.predicate == "rdf:type") & (df.object == "KnownExploitedVulnerability")].subject)757exploit_cves = set(df[df.predicate == "exploits-cve"].object)758 759# Join package → GHSA → CVE → enrichment760risk = packages.merge(ghsa_cve, on="ghsa").merge(epss_scores[["subject", "epss"]], left_on="cve", right_on="subject")761risk["in_kev"] = risk.cve.isin(kev_cves)762risk["has_exploit"] = risk.cve.isin(exploit_cves)763risk["ecosystem"] = risk.pkg.str.split("/").str[0]764 765# Top ecosystems by high-risk CVE count766high_risk = risk[(risk.epss > 0.5) | risk.in_kev | risk.has_exploit]767print(high_risk.groupby("ecosystem").cve.nunique().sort_values(ascending=False).head(10))768```769 770### CAPEC → CWE → CVE (Attack Pattern Chain)771 772```python773capec = load_dataset("s0u9ata/security-kg", "capec")["train"].to_pandas()774cve = load_dataset("s0u9ata/security-kg", "cve")["train"].to_pandas()775 776# Find CWEs related to SQL Injection (CAPEC-66)777cwe_ids = capec[(capec.subject == "CAPEC-66") & (capec.predicate == "related-weakness")].object.tolist()778 779# Find CVEs with those CWEs780for cwe_id in cwe_ids:781    related_cves = cve[(cve.predicate == "related-weakness") & (cve.object == cwe_id)].subject.unique()782    print(f"{cwe_id}: {len(related_cves)} CVEs")783```784 785### D3FEND (Defensive Taxonomy)786 787```python788ds = load_dataset("s0u9ata/security-kg", "d3fend")789df = ds["train"].to_pandas()790 791# All 497 defensive techniques in the D3FEND taxonomy792defenses = df[(df.predicate == "rdf:type") & (df.object == "DefensiveTechnique")]793print(f"Defensive techniques: {len(defenses)}")794 795# Find children of a category (e.g., all techniques under Network Traffic Analysis)796children = df[(df.predicate == "child-of") & (df.object == "NetworkTrafficAnalysis")].subject.tolist()797 798# Get their names799names = df[df.predicate == "name"][["subject", "object"]]800print(names[names.subject.isin(children)].to_string(index=False))801```802 803## Source Licensing & Attribution804 805This dataset is published under the Apache 2.0 license. The underlying source data is provided under various licenses as detailed below. By using this dataset, you agree to comply with each source's respective terms.806 807| Source | License | Attribution |808|--------|---------|-------------|809| [ATT&CK](https://attack.mitre.org/resources/terms-of-use/) | Custom royalty-free (MITRE) | © The MITRE Corporation. Reproduced and distributed with the permission of The MITRE Corporation. |810| [CAPEC](https://capec.mitre.org/about/termsofuse.html) | Custom royalty-free (MITRE) | © The MITRE Corporation. Reproduced and distributed with the permission of The MITRE Corporation. |811| [CWE](https://cwe.mitre.org/about/termsofuse.html) | Custom royalty-free (MITRE) | © The MITRE Corporation. Reproduced and distributed with the permission of The MITRE Corporation. |812| [CVE](https://www.cve.org/Legal/TermsOfUse) | Custom permissive (MITRE) | © The MITRE Corporation. CVE® is a registered trademark of The MITRE Corporation. |813| [CPE / NVD](https://nvd.nist.gov/developers/terms-of-use) | Public domain (NIST) | This product uses data from the NVD API but is not endorsed or certified by the NVD. |814| [D3FEND](https://github.com/d3fend/d3fend-ontology) | MIT License | © The MITRE Corporation. MITRE D3FEND™ is a trademark of The MITRE Corporation. |815| [ATLAS](https://github.com/mitre-atlas/atlas-data) | Apache 2.0 | © MITRE. |816| [CAR](https://github.com/mitre-attack/car) | Apache 2.0 | © The MITRE Corporation. |817| [ENGAGE](https://engage.mitre.org/) | Apache 2.0 ([GitHub repo](https://github.com/mitre/engage/blob/main/LICENSE.md)) / Custom restrictive ([website ToU](https://engage.mitre.org/terms-of-use/)) | © The MITRE Corporation. Reproduced and distributed with the permission of The MITRE Corporation. Note: the GitHub repo is licensed Apache 2.0, but the website terms restrict use to internal/non-commercial purposes. Clarification pending with MITRE. |818| [F3](https://github.com/center-for-threat-informed-defense/fight-fraud-framework) | Apache 2.0 | © MITRE Engenuity, Center for Threat-Informed Defense. |819| [EPSS](https://www.first.org/epss/) | Custom permissive (FIRST) | Jacobs, Romanosky, Edwards, Roytman, Adjerid (2021), *Exploit Prediction Scoring System*, Digital Threats Research and Practice, 2(3). See [first.org/epss](https://www.first.org/epss/). |820| [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Public domain (U.S. Gov) | Source: CISA Known Exploited Vulnerabilities Catalog. |821| [Vulnrichment](https://github.com/cisagov/vulnrichment) | CC0 1.0 Universal | Source: CISA Vulnrichment. |822| [GHSA](https://github.com/github/advisory-database) | CC BY 4.0 | Source: GitHub Advisory Database. Licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). |823| [Sigma](https://github.com/SigmaHQ/sigma) | Detection Rule License 1.1 | Source: SigmaHQ. Licensed under [DRL 1.1](https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md). Rule author attribution is preserved in triples. |824| [ExploitDB](https://gitlab.com/exploit-database/exploitdb) | GPLv2+ | Source: OffSec ExploitDB. Derived factual metadata (IDs, CVE mappings, dates) extracted under [GPLv2+](https://www.gnu.org/licenses/old-licenses/gpl-2.0.html). |825| [MISP Galaxies](https://github.com/MISP/misp-galaxy) | CC0 1.0 / BSD 2-Clause | Source: MISP Project. Dual-licensed under [CC0 1.0](https://creativecommons.org/publicdomain/zero/1.0/) and [BSD 2-Clause](https://opensource.org/licenses/BSD-2-Clause). |826| [LOLBAS](https://github.com/LOLBAS-Project/LOLBAS) | GPLv3 | Source: LOLBAS Project. Licensed under [GPLv3](https://www.gnu.org/licenses/gpl-3.0.html). |827| [LOLDrivers](https://github.com/magicsword-io/LOLDrivers) | Apache 2.0 | Source: LOLDrivers (magicsword.io). |828| [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) | MIT License | Source: Red Canary Atomic Red Team. Licensed under [MIT](https://opensource.org/licenses/MIT). |829| [NIST 800-53 Mappings](https://github.com/center-for-threat-informed-defense/mappings-explorer) | Apache 2.0 | © MITRE Engenuity, Center for Threat-Informed Defense. |830| [Nuclei Templates](https://github.com/projectdiscovery/nuclei-templates) | MIT License | Source: ProjectDiscovery Nuclei Templates. Licensed under [MIT](https://opensource.org/licenses/MIT). |831| [EUVD](https://euvd.enisa.europa.eu/) | Public (ENISA) | Source: ENISA European Vulnerability Database. Data published by the European Union Agency for Cybersecurity. |832| [OSV](https://osv.dev/) | CC BY 4.0 | Source: OSV (osv.dev). Licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). |833 834## License835 836Apache 2.0 — see [Source Licensing & Attribution](#source-licensing--attribution) for individual source terms.837