Artemis: FedRAMP Security Graph Engine
Python and DSPy security graph linking FedRAMP controls to MITRE ATT&CK and D3FEND, with interactive coverage analysis and OSCAL output.
Problem
Compliance teams can't see how their control posture connects to real-world threats. Vulnerabilities, MITRE ATT&CK techniques, D3FEND defenses, and NIST 800-53 controls all live in separate spreadsheets, so nobody can answer 'which controls does this incident touch, and where are we actually undefended?' Building that picture by hand for a full FedRAMP baseline takes weeks and is stale the moment it's done.
Solution
Artemis ingests Vanta compliance data and runs a seven-stage pipeline that maps CVEs to MITRE ATT&CK techniques, techniques to D3FEND countermeasures, and countermeasures back to the organization's own controls. A DSPy program running Claude on Bedrock reasons over each of the 323 FedRAMP Moderate controls to build threat-aware implementation guidance, and the whole thing renders as an interactive, self-contained HTML graph plus a machine-readable OSCAL incident response plan.
Impact
- →Collapses incident-response-plan and gap-analysis authoring from multi-week manual effort to a single automated pipeline run (near-instant on re-runs thanks to DSPy caching).
- →Covers all 323 controls of the FedRAMP Moderate baseline across 18 NIST families, including all 17 Incident Response controls.
- →Classifies five distinct gap types (unmapped CVEs, uncovered techniques, undefended controls) with severity scoring and recommended remediation, exported to JSON and color-coded Excel.
- →Ships an interactive vis.js security graph with 2-hop neighborhood exploration and an embedded 'Ask Artemis' LLM chat scoped to prevent hallucination.
Architecture
- 01Stage 1 — Ingest: normalize Vanta JSON (people, controls, tests, frameworks, components) from S3 or local disk.
- 02Stage 2 — IRP: render Jinja2 control templates, annotate with framework coverage, run the 3PAO readiness heuristic, export Markdown + Word.
- 03Stage 3 — Attack mapping: resolve each vulnerability to MITRE ATT&CK techniques via CWE and keyword matching against cached STIX data.
- 04Stage 4 — Defense mapping: link techniques to D3FEND countermeasures and match them to Vanta controls, flagging undefended gaps.
- 05Stage 5 — Gap export: enumerate all five gap types with severity and remediation, writing JSON + styled Excel.
- 06Stage 6/7 — OSCAL + graph: emit OSCAL 1.2.1 IRP JSON, then a DSPy generator builds per-control implementation nodes and renders the interactive vis.js graph with an embedded Ask-Artemis endpoint.
Capabilities
- ·Ingest Vanta exports (vulnerabilities, controls, tests, frameworks, components, people) with a local-filesystem fallback for testing.
- ·Map vulnerabilities to MITRE ATT&CK techniques via CWE lookups plus keyword fallback, then to D3FEND countermeasures.
- ·Reason over all 323 FedRAMP Moderate controls with a DSPy program on Bedrock Claude, cached for fast re-runs.
- ·Generate a 17-section Incident Response Plan in Markdown and Word, plus OSCAL 1.2.1 JSON with embedded threat and countermeasure mappings.
- ·Export severity-scored gap analysis (five gap types) to JSON and color-coded Excel, plus an auto-graded 3PAO readiness checklist.
- ·Render an interactive, self-contained vis.js graph with search, click-to-inspect, and 2-hop neighborhood exploration.
- ·Expose the pipeline as an MCP server (Bedrock AgentCore) so Claude Code can run graph queries, gap reports, and 3PAO checks as tools.