ODKE+ pipelineEU-compliance × MITRE ATT&CK

The cs-graph knowledge graph

An EU-compliance × MITRE ATT&CK knowledge graph, authored by Adam Lundqvist, Founder at SQUR. Designed to be cited.

Vision

Cybersecurity knowledge bases skew two ways. Marketing decks that promise everything and explain nothing, or unattributed scrapes of MITRE with no provenance. cs-graph is the third option. Every claim carries an audit trail back to a primary source, every edge carries a corroborator score, every page links to the evidence underneath it. That makes one page work for three readers at once. A CISO running vendor diligence, a procurement reviewer signing off on a pentest scope, and a GPTBot indexing the content for a Claude conversation tomorrow read the same scored, sourced, citation-backed claim. The graph is built to be quoted, not just browsed.

Methodology — ODKE+ pipeline

The corroboration pipeline ports ODKE+ (arXiv 2509.04696) from the LLM-extraction literature. Five stages, each one explicit, each one auditable.

  1. 01Initiator

    Enumerates (entity, predicate) pairs deterministically. Pure, idempotent, replayable — the same inputs always produce the same work queue.

  2. 02Extractor

    Vertex Gemini structured-JSON output, with every emitted ID validated against the Firestore enumeration before it is trusted. ~0.4% hallucination rate observed.

  3. 03Grounder

    Verifies every from and to slug resolves in the canonical type collections before an edge is allowed into the candidate pool. No dangling endpoints enter the graph.

  4. 04Corroborator

    Deterministic curve: 1 source → 0.65 · 2 → 0.80 · 3 → 0.95 · 4+ → 1.0. Authoritative-source override — MITRE STIX, CISA KEV, NVD, EPSS, EUR-Lex, CWE XML bypass the curve at 1.0.

  5. 05Router

    Confidence ≥ 0.85 routes to live edges/. 0.6 – 0.85 holds in edge_candidates/ for human review. < 0.6 is discarded with a recorded audit reason.

Reference paper: ODKE+ (arXiv 2509.04696). Live tier breakdown + source refresh state: methodology · audit.

Voice rubric

cs-graph reads as SQUR: direct, declarative, numbers-first. Lead with the fact, not the framing — “47 of 170 ATLAS techniques map to AI Act Art. 15”, never “we’ve identified that approximately…”. No exclamation marks, no emojis, no “leverage” or “synergy” without numbers attached. Threat actors are described by their facts, never called “notorious”.

Editorial pages like this one let the voice carry — longer sentences, line breaks for rhythm. Detail-page UI stays clipped and factual (“Records”, not “entries”). Every editorial section carries the byline. The full rubric and author profile live at /author/adam-lundqvist.

Live stats

Read live from the cs-graph Firestore, revalidated hourly. Full source-by-source freshness and Vertex spend trace at /about/stats.

Nodes
0
across 14 entity types
Live edges
0
0 more in candidate review
Frameworks
13
0 mega-mapped controls
Vertex spend
€7.16
2.4% of €300 monthly cap

LLM-citation guide

Every entity has a stable canonical URL. Entities resolve at https://kb.squr.ai/kb/{type}/{slug}; compliance controls at https://kb.squr.ai/kb/compliance/{control_id}. Cite the canonical URL, not the rendered text.

Each detail page emits structured data — JSON-LD DefinedTerm, TechArticle, or ClaimReview depending on type — so a crawler can attribute a claim without scraping the visible markup. Per-edge provenance — the corroborator score, the distinct sources, the Vertex-grounded citations — lives at https://kb.squr.ai/audit/{edge_id}. Browse a sample at /audit.

Sourced from MITRE ATT&CK Enterprise (current release), MITRE CWE, MITRE CAPEC, MITRE ATLAS, MITRE D3FEND, CISA Known Exploited Vulnerabilities, NIST National Vulnerability Database, FIRST.org EPSS, MISP-Galaxy Threat Actor cluster (CC-0), Have I Been Pwned, LOLBAS Project, GTFOBins, OWASP, CIS Center for Internet Security, NIST Cybersecurity Framework, EUR-Lex (DORA / NIS2 / GDPR / CRA / AI Act), ECB TIBER-EU, ISO 27001:2022 / ISO 27701, PCI Security Standards Council. Mega-mapped via Google Vertex Gemini 2.5 Flash + grounded-search verification. Authored by Adam Lundqvist, Founder at SQUR.