Adding a new attributes, objects to represent resource relationships as a graph.

[floydtree]

Description of changes:

1. Adding a graph object. Adding constituent node, edge objects. This object is designed using existing JSON graph representation, with a few modifications to maintain consistency with OCSF.
2. Creating a new attribute relationship_graph of type graph. Adding it as an optional attribute of resource_details object.

---

A simple exemplification of the proposed graph structure. -
The following represents relationships of an EC2 instance, which is a target resource of a particular finding. The information added via these relationships, can be considered as supplementary information about the resource itself. Note that, it's not establishing relationships amongst intra-event resources/entities. Although that's another potential use-case of this object.

{
    "resource_relationship": {
        "desc": "Relationships for SampleEC2Instance",
        "name": "SampleEC2Instance Relationships",
        "type": "Resource Relationship Graph",
        "uid": "UID of the relationship graph",
        "edges": [
            {
                "name": "InstanceToSG",
                "relation": "IsAssociatedWith",
                "source": "Instance ARN",
                "target": "SG ARN",
                "uid": "UID of the edge"
            },
            {
                "name": "InstanceInVPC",
                "relation": "IsContainedIn",
                "source": "Instance ARN",
                "target": "VPC ARN",
                "uid": "UID of the edge"
            },
            {
                "name": "InstanceToVolume",
                "relation": "IsAttachedTo",
                "source": "Instance ARN",
                "target": "EBS ARN",
                "uid": "UID of the edge"
            },
            {
                "name": "InstanceToInstanceProfile",
                "relation": "IsAssociatedWith",
                "source": "Instance ARN",
                "target": "Instance Profile ARN",
                "uid": "UID of the edge"
            },
            {
                "name": "InstanceProfiletoIAMRole",
                "relation": "IsAssociatedWith",
                "source": "Instance Profile ARN",
                "target": "IAM Role ARN",
                "uid": "UID of the edge"
            },
            {
                "name": "IAMRoletoIAMPolicy",
                "relation": "IsAttachedTo",
                "source": "IAM Policy ARN",
                "target": "IAM Role ARN",
                "uid": "UID of the edge"
            }
        ],
        "nodes": [
            {
                "name": "SampleEC2Instance",
                "type": "EC2Instance",
                "uid": "Instance ARN"
            },
            {
                "name": "WebServer SG",
                "type": "SecurityGroup",
                "uid": "SG ARN"
            },
            {
                "name": "Production VPC",
                "type": "VPC",
                "uid": "VPC ARN"
            },
            {
                "name": "EBS Volume",
                "type": "EBS",
                "uid": "EBS ARN"
            },
            {
                "name": "My Instance Profile",
                "type": "EC2 Instance Profile",
                "uid": "Instance Profile ARN"
            },
            {
                "name": "My Role",
                "type": "IAM Role",
                "uid": "IAM Role ARN"
            },
            {
                "name": "My Policy",
                "type": "IAM Policy",
                "uid": "IAM Policy ARN"
            }
        ]
    }
}

The above can be simply rendered as ->

[jonrau-at-queryai]

I really love this. Some suggestions, clarifications.

[zschmerber]

LGTM

[Aniak5]

LGTM! Awesome work @floydtree , this is such a great idea!

[jonrau-at-queryai]

LFG! 🔥

[zschmerber]

New OCSF graph visuals going to get some frontend dev promoted..