Knowledge graph · Data engineering

Atlas Graph

Five fragmented security sources become one traceable graph. Explore every path from an external entry point to critical data, then test which control removes the most risk.

  • 5 synthetic sources
  • Attack-path search
  • What-if remediation
  • POST /api/graph

Personal project on synthetic data · Not an employer system

Architecture

  • Graph traversal
  • Entity resolution
  • Lineage
  • What-if analysis
  1. Source recordsEDR, CMDB, scanner, identity provider, and cloud audit logs
  2. Entity resolutionWeighted field match: MATCH, REVIEW, or NO_MATCH
  3. Security graphDirected edges with a relation, likelihood, and control
  4. Path searchEvery route from the internet to critical data, ranked
  5. What-if remediationRemove one control’s edge and recount the paths

Run it

  1. Pick a remediation scenario
  2. Watch reachable paths and the top score change
  3. Select a path to trace it on the graph

What this showsData engineering · Entity resolution · Graph modeling · Risk prioritization

Remediation scenario

POST/api/graphReady

Reachable critical paths
6of 6 before remediation
Paths removed
0no change
Top path score
36.7%edge-likelihood product
Graph coverage
8entities from 5 sources
Synthetic security graph8 entities and 9 active relationships. Highlighted path: Internet to Riley Park to FIN-LT-042 to Finance App to Data Warehouse, score 36.7%.exposed service · likelihood 0.82 · control: WAF policyservice credential · likelihood 0.63 · control: secret rotation71%phishing · likelihood 0.71 · control: phishing-resistant MFA91%assigned endpoint · likelihood 0.91 · control: EDR isolationactive session · likelihood 0.74 · control: session revocation66%trusted device · likelihood 0.66 · control: device complianceSSO access · likelihood 0.79 · control: conditional access86%read/write role · likelihood 0.86 · control: least privilegereplication role · likelihood 0.57 · control: network segmentationInternetexternalPublic APIapplicationRiley ParkidentityFIN-LT-042assetIdentity GatewayapplicationFinance AppapplicationData WarehousedataBackup Vaultdata

Ranked critical paths

Select a path to trace it on the graph

Entity resolution · FIN-LT-042

Weighted field comparison against the EDR record · link ≥ 0.72 · review ≥ 0.60

EDRAnchor record
Hostname
FIN-LT-042
Device ID
D-8042
IP
10.20.4.42
Owner
Riley Park
OS
Windows 11 Enterprise
CMDBLinked
Hostname
finlt042.corp.example
Device ID
D-8042
IP
10.20.4.42
Owner
Park, Riley
OS
Windows 11 Enterprise
0.86weighted score
  • Device ID+0.36
  • Hostname+0.15
  • Owner+0.13
  • IP address+0.12
  • Operating system+0.10
Vulnerability scannerNeeds review
Hostname
fin-lt-042
Device ID
not recorded
IP
10.20.4.42
Owner
riley.park
OS
Windows 11 Enterprise
0.64weighted score
  • Device ID+0.00
  • Hostname+0.27
  • Owner+0.15
  • IP address+0.12
  • Operating system+0.10

2 of 3 records link automatically; borderline pairs go to analyst review. Weights are hand-set for this demo.

Path score multiplies assumed edge likelihoods to rank paths.

Decisions, evidence, and limits

The problem

Security tools describe the same users, devices, services, and findings with different identifiers. Without trustworthy identity and relationships, downstream analytics produce duplicate alerts and misleading attack paths.

How it works

Compare source records field by field to link them into canonical entities with lineage, build a directed security graph, and enumerate every path from an exposed entry point to each critical data store. Every edge carries a relationship, an assumed likelihood, and the control that would remove it.

Baseline

The baseline graph uses exact identifiers and all observed edges. The enhanced pipeline links noisy records with weighted field comparisons, routes borderline pairs to review, and preserves the evidence behind each canonical entity.

What is measured

The live API reports reachable critical paths, the top path score, paths removed by each remediation, source coverage, and field-level match evidence. Path score is the product of edge likelihoods: a heuristic for ranking, not a probability of compromise.

Failure modes

Missing telemetry can hide edges, stale access data can create paths that no longer exist, and correlated edge assumptions make multiplicative scores optimistic. Match weights are hand-set here and must be learned and calibrated on reviewed pairs before production use.

Production tradeoffs

Process source snapshots with Spark, store the versioned graph in a graph database, learn entity-resolution weights from reviewed pairs, enforce field-level lineage, and validate proposed attack paths with asset owners before driving remediation.