Knowledge Graph Relationship Vocabulary & Semantics

Strict Controlled Taxonomy

Hermes AI pipelines are strictly forbidden from inventing arbitrary relationship labels. Every edge in the Knowledge Graph must adhere to the 25 controlled relationship verbs defined below.

1. Controlled Vocabulary & Directional Semantics

Relationship Type	Source Entity	Target Entity	Semantic Definition
affects	vulnerability	product	The software component contains the security flaw.
manufactured_by	product	vendor	The product is engineered, packaged, or supported by the vendor.
exploits	exploit / malware / vulnerability	vulnerability / agentic_attack_pattern	Directly leverages the weakness to achieve kinetic subversion.
exploited_by	vulnerability	threat_actor / malware	Inverse relation indicating confirmed hostile abuse in the wild.
associated_with	Any	Any	Documented co-occurrence across threat intelligence reports.
attributed_to	campaign / malware	threat_actor	Formal forensic attribution supported by behavioral or network evidence.
used_in	exploit / malware	campaign	Weaponry observed deployed within an operational offensive wave.
targets	threat_actor / campaign	product / sector	Deliberate adversary focus on specific platforms or industries.
uses	threat_actor / vulnerability	attack_technique	Employs a recognized MITRE ATT&CK or adversarial procedure.
implements	malware / exploit	agentic_attack_pattern	Programmatic embodiment of an agentic attack mechanism.
enables	vulnerability / technique	vulnerability / technique	Prerequisite condition facilitating a downstream exploitation stage.
leads_to	vulnerability	impact / technique	Direct causal chain resulting in system compromise.
detected_by	vulnerability / technique	detection	Sigma, YARA, or Osquery signature that identifies exploitation activity.
leaves_artifact	vulnerability / technique	forensic_artifact	Identifiable residue created in disk, memory, or audit journals.
mitigated_by	vulnerability / agentic_attack_pattern	defense / guideline	Architectural countermeasure reducing or neutralizing risk.
fixed_by	vulnerability	patch / version	Formal vendor remediation eradicating the code defect.
observed_in	exploit / technique	campaign / incident	Empirically verified in incident response forensic logs.

---

2. Relationship Lifecycle States

Relationships are not static facts; they undergo epistemological transitions as evidence accumulates:

  [CANDIDATE]
       │
       ▼ (Automated or Analyst Triage)
 [UNDER_REVIEW]
       │
       ▼ (Evidence Corroboration)
  [VALIDATED]
       │
       ▼ (Editorial Publication)
  [PUBLISHED] ◄────────┐
       │               │
       ├───────────────┼───────────────┐
       ▼               ▼               ▼
  [CONTESTED]     [SUPERSEDED]    [RETRACTED]

• CANDIDATE: Proposed by automated NLP or intelligence scrapers without independent corroboration.
• PUBLISHED: Fully validated, backed by multiple credible sources, and embedded into production feeds.
• CONTESTED: Conflicting intelligence exists between reputable sources (e.g., vendor denies exploitation vs. researcher claims zero-day in the wild).
• RETRACTED: Preserved with audit logs explaining that the initial attribution or causal claim was disproven.