Classifyre Docs

Semantic Layer

The Semantic Layer translates raw detection data into business-friendly concepts. It provides a single source of truth for metric definitions, ensuring everyone from security engineers to compliance officers sees the same numbers.

6 glossary terms6 active metrics4,420 mapped findings

What Is a Semantic Layer?

Business Glossary

Maps business terms like “Security Threats” or “PII Exposure” to technical detector types and filter configurations. Non-technical stakeholders use familiar language while the system translates to precise queries.

Governed Metrics

Metrics are defined once and calculated consistently everywhere—dashboards, APIs, MCP tools, and reports. No more ad-hoc calculations that drift between teams.

Dimensions

Standardized slicing axes (severity, detector type, status, category) let users drill into any metric. Dimension access is governed per metric definition.

Raw Finding Data→Glossary Filter→Metric Engine→Business Value

Business Glossary

Each glossary term maps a business concept to a set of technical filters. When a user queries “Security Threats,” the system translates that into detector types like SECRETS, YARA, and PROMPT_INJECTION.

Security Threats

Security

Findings from detectors that identify security vulnerabilities such as exposed secrets, malicious patterns, and prompt injection attempts.

SECRETSYARAPROMPT_INJECTION

1,284 findings·3 metrics

PII Exposure

Privacy

Personally identifiable information detected across data sources, including SSNs, email addresses, phone numbers, and government IDs.

PIIPHI

856 findings·2 metrics

Compliance Violations

Compliance

Findings that indicate regulatory non-compliance including GDPR data handling issues and HIPAA protected health information exposure.

COMPLIANCEGDPRHIPAA

342 findings·2 metrics

Content Safety Issues

Content

Content flagged for toxicity, bias, NSFW material, or other safety concerns that could pose reputational or legal risk.

TOXICNSFWBIAS

178 findings·1 metrics

Critical Findings

Security

All findings classified as critical severity, regardless of detector type. These require immediate attention and remediation.

CRITICAL

94 findings·1 metrics

Unresolved Issues

Operations

All open findings that have not yet been resolved, marked as false positive, or acknowledged by a team member.

OPEN

1,621 findings·2 metrics

Governed Metrics

Every metric has a single, versioned definition with governance metadata: who owns it, whether it’s certified, and which dimensions it supports.

Total FindingsSIMPLEACTIVE

Total count of all findings detected across all sources and detector types.

severitydetectorTypestatuscategory

3,847

findings

Open FindingsSIMPLEACTIVE

Count of findings currently in OPEN status requiring review or remediation.

severitydetectorTypecategory

1,621

findings

False Positive RateRATIOACTIVE

Percentage of findings that were marked as false positives out of all reviewed findings. Lower is better.

detectorTypecategory

8.2%

Resolution RateRATIOACTIVE

Percentage of findings that have been resolved. Measures team effectiveness at addressing detected issues.

severitydetectorType

57.8%

Scan CoverageRATIOACTIVE

Ratio of assets with at least one finding to total assets. Indicates how thoroughly assets are being scanned.

73.4%

Average ConfidenceSIMPLEACTIVE

Mean confidence score across all findings. Higher values indicate more reliable detections.

detectorTypeseverity

0.87

score

Weekly Finding TrendTRENDDRAFT

Week-over-week change in total findings. Positive values indicate an increase in detections.

12.0%

change

Metric Types

SIMPLESimple Metrics

Single aggregation over an entity. Supports COUNT, COUNT_DISTINCT, SUM, AVG, MIN, MAX.

{
  "aggregation": "COUNT",
  "entity": "finding",
  "filters": { "statuses": ["OPEN"] }
}

RATIORatio Metrics

Divides a numerator by a denominator. Each side can be an inline definition or reference another metric.

{
  "numerator": {
    "aggregation": "COUNT",
    "filters": { "statuses": ["FALSE_POSITIVE"] }
  },
  "denominator": {
    "aggregation": "COUNT",
    "entity": "finding"
  }
}

DERIVEDDerived Metrics

Arithmetic formula combining other metric values. Input metrics are evaluated first, then the formula is computed.

{
  "formula": "open_findings * 100 / total_findings",
  "inputs": ["open-findings", "total-findings"]
}

TRENDTrend Metrics

Compares a base metric across two time windows to calculate period-over-period change.

{
  "baseMetricSlug": "total-findings",
  "compareWindow": "7d",
  "currentWindow": "7d"
}

Live Metric Values

Governed metrics are evaluated in real-time against the database. The cards below show sample output from the metric engine.

Total Findings

3,847

findings

Open Findings

1,621

findings

False Positive Rate

8.2%

Resolution Rate

57.8%

Scan Coverage

73.4%

Average Confidence

0.87

score

Dimension Breakdowns

Metrics can be sliced by allowed dimensions. The metric engine returns both the scalar value and an optional breakdown array.

Total Findings

CRITICAL

HIGH

612

MEDIUM

1,843

LOW

987

INFO

311

Open Findings

SECRETS

423

PII

387

COMPLIANCE

298

YARA

245

TOXIC

134

CUSTOM

134

Getting Started

1. Define Glossary Terms

Navigate to /semantic/glossary/new in the web app. Map a business concept to detector types, severities, or statuses. Preview how many findings match before saving.

2. Create Metrics

Go to /semantic/metrics/new. Choose a type (SIMPLE, RATIO, DERIVED, TREND), configure the definition, and select which dimensions can slice it.

3. Certify & Govern

Metrics start in DRAFT status. Certify them to mark as ACTIVE. Certified metrics carry governance metadata: owner, certification date, and certifier identity.

4. Explore & Query

Use the Metric Explorer at /semantic/explore to interactively query metrics with glossary term scoping and dimension breakdowns.

API Reference

The semantic layer exposes REST endpoints under /semantic/. See the sub-pages for detailed endpoint documentation.

Method	Endpoint	Description
GET	/semantic/glossary	List all glossary terms
POST	/semantic/glossary	Create a glossary term
GET	/semantic/metrics	List all metric definitions
POST	/semantic/metrics	Create a metric definition
POST	/semantic/metrics/:slug/certify	Certify a metric (DRAFT → ACTIVE)
POST	/semantic/query	Evaluate a metric with filters
POST	/semantic/query/timeseries	Evaluate metric as time series
POST	/semantic/query/dashboard	Batch-evaluate dashboard metrics