Approachable

The default ICDB graph models threat activity with a small, focused set of node and edge types. Nodes are Cluster, HBI (host-based indicator), NBI (network-based indicator), Detection, Account, Event, and System. Edges read like English: forms, detects, observed on, attributed to, performed by, leads to, and related to. If you can read the edge label, you understand the relationship.

No 40-page specification to read before you can create your first node. The graph is self-documenting: every type and edge has a semantic label, and the schema viewer shows exactly which node types each edge can connect.

And when your team needs a custom schema, maybe you work in fraud instead of malware, or you need to model supply chain risk, the graph is fully extensible. Define your own node types, edge types, and properties. Start with the default, evolve from there.