Learning Graph¶

Interactive Concept Dependency Graph¶

The viewer below renders all 170 Nexus SecOps concepts as an interactive force-directed graph. Color encodes the 10 taxonomy categories. Shape encodes structural role:

The Two-Plane Model¶

Dan McCreary's methodology distinguishes two planes that work together:

graph LR
  subgraph CONCEPT["Concept Plane (green)"]
    direction TB
    C1[CIA Triad] --> C2[Defense in Depth]
    C2 --> C3[SOC]
    C1 --> C4[Security Event]
  end

  subgraph CONTENT["Content Plane (blue)"]
    direction TB
    CH1[Chapter 1]
    SIM1[MicroSim: Alert Triage]
    LAB1[Lab 1: Triage]
  end

  C3 -->|taught_by| CH1
  C4 -->|taught_by| SIM1
  C3 -->|practiced_in| LAB1

• Concept Plane — the 170 nodes in this learning graph (pure knowledge structure)
• Content Plane — the 15 chapters, 10 MicroSims, 5 labs, and 220 controls
• Linking Layer — each content item maps to one or more concepts; each concept appears across multiple resources

Taxonomy Categories¶

The 10 categories were chosen to evenly distribute the 170 concepts across the Nexus SecOps domain:

Foundation Concepts¶

These 5 concepts have no prerequisites — they are the starting points for all learning paths. Every learner begins here regardless of experience level.

Goal Concepts¶

These 9 concepts represent advanced synthesis outcomes — learners who master these have integrated knowledge across multiple prerequisite chains.

AI-Generated Learning Paths¶

The learning graph enables three role-specific curricula derived from shortest-path traversal between foundation and goal concepts:

CIA Triad → Security Event → Security Incident → Log Source → Telemetry →
SIEM → Log Normalization → Detection Rule → Alert Prioritization →
Severity Scoring → Alert Triage → Runbook

CIA Triad → Security Event → Log Source → Telemetry → SIEM →
Detection Rule → MITRE ATT&CK Framework → TTP → Use Case →
Sigma Rule Format → Detection Logic → Time Window → Correlation Rule →
Baseline → Anomaly Detection → Detection Coverage → Detection Testing →
Detection Engineering

Machine Learning → Training Data → Test Data → Supervised Learning →
Classification → True Positive → False Positive → True Negative →
False Negative → Confusion Matrix → Precision → Recall → F1 Score →
ROC Curve → AUC → Evaluation Framework

Data Files¶

The learning graph is stored in three machine-readable formats for downstream use:

CSV Interchange Format¶

Following McCreary's standard, the dependency file uses pipe-delimited prerequisite IDs in the third column. Foundation concepts have an empty third column:

ConceptID,DependsOnConceptIDs,DependencyRationale
C001,,Foundational security principle - no prerequisites
C002,C001,Defense in depth applies CIA triad across layers
C004,C003,ATT&CK expands on kill chain with detailed TTPs
C059,C017|C060,Correlation combines multiple detection rules

Validation Rules¶

A valid Nexus SecOps Learning Graph must satisfy all of the following:

• [x] All non-foundational concepts have ≥ 1 dependency
• [x] No self-dependencies (a concept cannot depend on itself)
• [x] Graph is acyclic (no circular prerequisite chains)
• [x] No orphaned nodes (every node connects to at least one other)
• [x] The graph is fully connected (no disconnected subgraphs)
• [x] No category exceeds 30% of total concepts (T02 is largest at 18.8%)

Using This Graph with AI¶

The learning graph serves as context for AI-assisted personalization. The recommended pattern (GraphRAG) is to load the concept nodes and edges into the LLM context window, then query:

# Example: find the shortest learning path to a goal concept
prompt = """
Given this Nexus SecOps concept dependency graph in JSON format:

{graph_json}

I want to learn 'Detection Engineering' (C078).
I already know: CIA Triad, Security Event, Log Source, SIEM.
What is the shortest ordered list of concepts I need to learn next?
Return as a numbered list with a one-sentence rationale for each concept.
"""

This technique is implemented in scripts/alpha_discovery.py of the companion Ironclad Growth project and can be adapted for personalized Nexus SecOps curriculum generation.

Concept Graph MicroSim¶

Explore how prerequisite chains form in a small sub-graph using the interactive p5.js simulation:

Open full screen

Learning graph generated from McCreary's Concept Dependency Graph methodology. Data files are version-controlled and auto-regenerated on each release.