Data models

Introduction to data models¶

Data models are the most central element of Brinqa applications, structuring and determining relationships between all data and objects in the system.

Data models are referred to in two ways within Brinqa applications. When an administrator creates a data model, they are creating a set of attributes that objects of that type will have in the system. That data model is a structure used to build datasets. “Data model” can also refer to the group of all datasets built with that structure. So, when an administrator is creating a report and selects a data model to be visualized, they are selecting the group of datasets to display.

Creating a data model structure allows you to specify which pieces of data you want to store about particular objects in your system. For example, the ticket data model defines what attributes will exist for tickets in your application. Some of these attributes might be ticket id, title, creation date, and due date. Your administrator can determine exactly what pieces of data will be relevant to your team and omit anything you consider superfluous, even if that data is provided by your data sources like Qualys or Service Now. Once a set of attributes has been assembled into a data model, the attributes can be mapped to data sources that will populate them for each instance of that object created within the system.

Data models also allow you to build relationships between individual attributes and other data models. For example, vulnerabilities have a number of attributes, one of which is risk rating. Risk rating is calculated from another vulnerability attribute, risk score, which is in turn calculated from other vulnerability attributes like base CVSS score. Another vulnerability attribute is host. Host objects themselves have many attributes, like IP address, operating system, and owner. The relationship between the vulnerability data model and the host data model means that you can quickly display information like vulnerabilities by host IP or operating system, without storing host operating system as a piece of data about a vulnerability.

Purpose of data models¶

Apart from serving as the structure for objects within your applications, data models make it possible to automate data input and normalize data from different sources. By specifying characteristics certain objects should have, you can then map those characteristics to characteristics of objects in various data sources. When the data source provides information on a mapped object, it is then created according to the data model configurations within your Brinqa application. Data models normalize data by using the same structure for information from disparate sources. Having one vulnerability data model and mapping multiple sources to it means that information from different sources is restructured in a way that makes it easy to compare.

Data models also allow you to build your business model into the system by associating things like departments and business units with hosts, creating contextual information for vulnerabilities. For example, some hosts will be associated with certain business units that provide critical business functions. A high risk rating for that host will be more important to address than a high risk rating on a host that provides non-critical functions.

Default data models¶

Brinqa applications come with many pre-defined data models. Each application will start with different default data models. Data models defined at the platform level will be available to all Brinqa applications, whereas data models defined within a particular application will only be available to that application.

Table 1. Default Platform data models

Table 2. Default Threat & Vulnerability Management data models

Working with data models¶

Administration > Data Management > Data Models will take you to the Manage Data Models page, which displays a list view of all existing data models.

Table 3: List view contents

Create a new data model¶

1. Navigate to Administration > Data Management > Data Models
2. Click Create Data Model
3. Fill in the following and click Create:

Table 4: New data model properties

Adding attributes¶

Once the data model has been saved its attributes can be created. All data models will start with some attributes based on the classification selected during creation.

An attribute should be created for every piece of data you’ll want to gather about this type of object. The attributes you select for each data model will determine what’s available when creating mappings to data sources.

For more information on creating attributes, navigate to the Attributes section of the documentation.

Working with attributes¶

Attributes associated with a data model appear on a list view in the middle of the data model edit/create form.

The list view allows you to edit, delete, and order attributes. Attributes can be ordered by dragging them up or down the list. Order is referenced by calculated attributes. For example, the calculation for Risk Rating refers to Risk Score, which is itself a calculated value. Placing Risk Score higher on the attribute list ensures it is calculated first, and is therefore available for the Risk Rating calculation later.

Table 5: Attribute list view contents

Deleting data models¶

Data models are the most central element of Brinqa applications and therefore have a large number of dependencies. To delete a data model, it can't be in use anywhere else in the system. If a data model is referenced by a data mapping, data set (individual instance of a data model), data model mapping, mail template, notification, rule, close ticket action, create ticket action or a child model, it is considered in use and cannot be deleted.

If you do delete a data model, all views associated with that data model (show, list, and form) will also be deleted.