Use Cases

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

// ========================================
// FRIEND SUGGESTIONS (People You May Know)
// ========================================
 
// Friends of friends, weighted by mutual connections
MATCH (me:User {id: $userId})-[:FRIEND]->(friend:User)-[:FRIEND]->(suggested:User)
WHERE NOT (me)-[:FRIEND]-(suggested)
  AND me <> suggested
  AND NOT (me)-[:BLOCKED]-(suggested)
WITH suggested, count(DISTINCT friend) AS mutualFriends,
     collect(friend.name)[0..3] AS sampleMutuals
WHERE mutualFriends >= 2
RETURN suggested.id, suggested.name, 
       mutualFriends, sampleMutuals
ORDER BY mutualFriends DESC
LIMIT 20
 
// Enhanced: include workplace/school overlap
MATCH (me:User {id: $userId})
OPTIONAL MATCH (me)-[:WORKS_AT]->(company:Company)<-[:WORKS_AT]-(coworker:User)
OPTIONAL MATCH (me)-[:STUDIED_AT]->(school:School)<-[:STUDIED_AT]-(classmate:User)
OPTIONAL MATCH (me)-[:FRIEND]->(:User)-[:FRIEND]->(foaf:User)
WHERE NOT (me)-[:FRIEND]-(coworker) AND NOT (me)-[:FRIEND]-(classmate)
WITH me, 
     collect(DISTINCT {user: coworker, source: "work"}) + 
     collect(DISTINCT {user: classmate, source: "school"}) + 
     collect(DISTINCT {user: foaf, source: "mutual"}) AS suggestions
UNWIND suggestions AS s
WHERE s.user IS NOT NULL AND s.user <> me
RETURN s.user.name, collect(s.source) AS connectionTypes,
       size(collect(s.source)) AS connectionStrength
ORDER BY connectionStrength DESC
LIMIT 15
 
// ========================================
// CONNECTION DEGREE
// ========================================
 
// Find connection path between two users
MATCH path = shortestPath(
    (me:User {id: $myId})-[:FRIEND*..6]-(target:User {id: $targetId})
)
RETURN 
    CASE length(path)
        WHEN 1 THEN "1st degree (direct connection)"
        WHEN 2 THEN "2nd degree"
        WHEN 3 THEN "3rd degree"
        ELSE toString(length(path)) + " degrees away"
    END AS connectionDegree,
    [n IN nodes(path) | n.name] AS connectionPath
 
// ========================================
// FEED RANKING (Social Proximity)
// ========================================
 
// Posts from network, scored by social distance
MATCH (me:User {id: $userId})-[:FRIEND*1..2]-(author:User)-[:POSTED]->(post:Post)
WHERE post.createdAt > datetime() - duration('P7D')
WITH post, author,
     CASE size((me)-[:FRIEND*1..1]-(author)) 
         WHEN 1 THEN 1.0   // Direct friend
         ELSE 0.5         // Friend of friend
     END AS socialScore,
     duration.between(post.createdAt, datetime()).hours AS hoursAgo
WITH post, author, socialScore,
     1.0 / (1.0 + toFloat(hoursAgo) / 24) AS recencyScore,
     toFloat(post.likes + post.comments * 2) / 100 AS engagementScore
RETURN post.id, author.name, post.content,
       socialScore * 0.4 + recencyScore * 0.3 + engagementScore * 0.3 AS feedScore
ORDER BY feedScore DESC
LIMIT 50
 
// ========================================
// INFLUENCE ANALYSIS
// ========================================
 
// Identify influencers via follower analysis
MATCH (user:User)
WITH user, 
     size((user)<-[:FOLLOWS]-()) AS followers,
     size((user)-[:FOLLOWS]->()) AS following
WHERE followers > 10000
RETURN user.name, followers, following,
       toFloat(followers) / CASE following WHEN 0 THEN 1 ELSE following END AS influenceRatio
ORDER BY followers DESC
LIMIT 50

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

// ========================================
// FRAUD RING DETECTION
// ========================================
 
// Find accounts sharing multiple identifiers (classic ring pattern)
MATCH (a1:Account)-[:USES]->(shared)<-[:USES]-(a2:Account)
WHERE a1 <> a2
  AND (shared:Device OR shared:IPAddress OR shared:Phone OR shared:Address)
WITH a1, a2, count(DISTINCT shared) AS sharedIdentifiers,
     collect(labels(shared)[0]) AS identifierTypes
WHERE sharedIdentifiers >= 2
RETURN a1.id, a2.id, sharedIdentifiers, identifierTypes
ORDER BY sharedIdentifiers DESC
 
// Extended: find connected fraud communities
MATCH (suspicious:Account)-[:USES*1..2]-(connected:Account)
WHERE suspicious.riskScore > 80
WITH suspicious, connected, 
     shortestPath((suspicious)-[:USES*]-(connected)) AS path
WHERE length(path) <= 3 AND suspicious <> connected
RETURN suspicious.id AS suspiciousAccount,
       collect(DISTINCT connected.id) AS connectedAccounts,
       size(collect(DISTINCT connected.id)) AS networkSize
ORDER BY networkSize DESC
 
// ========================================
// MONEY LAUNDERING - CIRCULAR TRANSFERS
// ========================================
 
// Detect circular money flows (structuring)
MATCH cycle = (origin:Account)-[:TRANSFERRED*3..8]->(origin)
WHERE ALL(r IN relationships(cycle) 
          WHERE r.timestamp > datetime() - duration('P1D')
          AND r.amount < 10000)  // Under reporting threshold
WITH origin, cycle,
     REDUCE(total = 0, r IN relationships(cycle) | total + r.amount) AS totalFlow,
     length(cycle) AS hops
WHERE totalFlow > 50000  // Significant total despite small individual transfers
RETURN origin.id,
       [n IN nodes(cycle) | n.id] AS flowPath,
       totalFlow, hops
 
// Rapid pass-through (layering)
MATCH (source:Account)-[t1:TRANSFERRED]->(intermediary:Account)-[t2:TRANSFERRED]->(dest:Account)
WHERE t1.timestamp > datetime() - duration('PT1H')
  AND t2.timestamp > t1.timestamp
  AND duration.between(t1.timestamp, t2.timestamp).minutes < 30
  AND t1.amount > 5000
  AND abs(t1.amount - t2.amount) < 100  // Nearly same amount
  AND NOT (source)-[:NORMAL_BUSINESS_WITH]-(dest)
RETURN source.id AS sourceAccount,
       intermediary.id AS layeringAccount,
       dest.id AS destinationAccount,
       t1.amount, t2.amount
 
// ========================================
// SYNTHETIC IDENTITY DETECTION
// ========================================
 
// Identities with unusual attribute sharing patterns
MATCH (identity:Person)
OPTIONAL MATCH (identity)-[:HAS_SSN]->(ssn:SSN)<-[:HAS_SSN]-(other1:Person)
OPTIONAL MATCH (identity)-[:HAS_ADDRESS]->(addr:Address)<-[:HAS_ADDRESS]-(other2:Person)
OPTIONAL MATCH (identity)-[:HAS_PHONE]->(phone:Phone)<-[:HAS_PHONE]-(other3:Person)
WITH identity,
     count(DISTINCT other1) AS ssnSharing,
     count(DISTINCT other2) AS addressSharing,
     count(DISTINCT other3) AS phoneSharing,
     identity.accountAge AS accountAge
WHERE ssnSharing > 0 
   OR (addressSharing > 3 AND accountAge < 365)
   OR (phoneSharing > 5)
RETURN identity.id,
       ssnSharing, addressSharing, phoneSharing, accountAge,
       ssnSharing * 10 + addressSharing * 3 + phoneSharing * 2 AS riskScore
ORDER BY riskScore DESC
 
// ========================================
// REAL-TIME TRANSACTION SCORING
// ========================================
 
// Score transaction at payment time
WITH $transactionData AS txn
MATCH (payer:Account {id: txn.payerId})
MATCH (payee:Account {id: txn.payeeId})
 
// Check for shared identifiers with flagged accounts
OPTIONAL MATCH (payer)-[:USES*1..2]-(flagged:Account {status: "FLAGGED"})
WITH payer, payee, txn, count(DISTINCT flagged) AS flaggedConnections
 
// Check payee's transaction pattern
OPTIONAL MATCH (payee)<-[recent:TRANSFERRED]-(others:Account)
WHERE recent.timestamp > datetime() - duration('PT1H')
WITH payer, payee, txn, flaggedConnections,
     count(DISTINCT others) AS recentUniquePayers
 
// Scoring
RETURN txn.id AS transactionId,
       CASE 
           WHEN flaggedConnections > 0 THEN "BLOCK"
           WHEN recentUniquePayers > 20 AND txn.amount > 1000 THEN "REVIEW"
           WHEN flaggedConnections = 0 AND recentUniquePayers < 5 THEN "APPROVE"
           ELSE "REVIEW"
       END AS decision,
       flaggedConnections,
       recentUniquePayers

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

// ========================================
// COLLABORATIVE FILTERING
// ========================================
 
// "Customers who bought this also bought..."
MATCH (p:Product {id: $productId})<-[:PURCHASED]-(c:Customer)-[:PURCHASED]->(other:Product)
WHERE other <> p
  AND NOT other.discontinued = true
WITH other, count(DISTINCT c) AS coPurchaseCount
ORDER BY coPurchaseCount DESC
LIMIT 10
RETURN other.id, other.name, coPurchaseCount
 
// User-based: find similar users, recommend their favorites
MATCH (me:Customer {id: $customerId})-[:PURCHASED]->(myProducts:Product)
WITH me, collect(myProducts) AS myPurchases
MATCH (similar:Customer)-[:PURCHASED]->(p:Product)
WHERE p IN myPurchases AND similar <> me
WITH me, similar, myPurchases, count(p) AS overlapCount
WHERE overlapCount >= 3  // Minimum overlap for similarity
ORDER BY overlapCount DESC
LIMIT 10
WITH me, myPurchases, collect(similar) AS topSimilarUsers
MATCH (s)-[:PURCHASED]->(rec:Product)
WHERE s IN topSimilarUsers 
  AND NOT rec IN myPurchases
RETURN rec.name, count(DISTINCT s) AS recommendedBy
ORDER BY recommendedBy DESC
LIMIT 20
 
// ========================================
// CONTENT-BASED FILTERING
// ========================================
 
// Similar products by shared attributes
MATCH (target:Product {id: $productId})-[:HAS_ATTRIBUTE]->(attr:Attribute)
WITH target, collect(attr) AS targetAttrs
MATCH (other:Product)-[:HAS_ATTRIBUTE]->(a:Attribute)
WHERE other <> target AND a IN targetAttrs
WITH target, other, count(a) AS sharedAttrs, targetAttrs
WITH target, other, sharedAttrs, 
     toFloat(sharedAttrs) / size(targetAttrs) AS similarity
WHERE similarity > 0.5
RETURN other.name, similarity, sharedAttrs
ORDER BY similarity DESC
LIMIT 10
 
// Category + brand + price range similarity
MATCH (target:Product {id: $productId})
MATCH (similar:Product)
WHERE similar <> target
  AND similar.category = target.category
  AND abs(similar.price - target.price) / target.price < 0.3
OPTIONAL MATCH (target)-[:BY_BRAND]->(b:Brand)<-[:BY_BRAND]-(similar)
RETURN similar.name, similar.price,
       CASE WHEN b IS NOT NULL THEN 1.5 ELSE 1.0 END AS brandBoost
ORDER BY brandBoost DESC, abs(similar.price - target.price)
LIMIT 10
 
// ========================================
// HYBRID RECOMMENDATIONS
// ========================================
 
// Combining social + content + behavioral signals
MATCH (me:Customer {id: $customerId})
 
// Social: what are friends buying?
OPTIONAL MATCH (me)-[:FRIEND]-(friend:Customer)-[:PURCHASED]->(socialRec:Product)
WHERE NOT (me)-[:PURCHASED]->(socialRec)
WITH me, collect({product: socialRec, score: 1.0, source: "social"}) AS socialRecs
 
// Behavioral: based on browsing history
OPTIONAL MATCH (me)-[:VIEWED]->(viewed:Product)-[:SIMILAR_TO]->(behavRec:Product)
WHERE NOT (me)-[:PURCHASED]->(behavRec)
WITH me, socialRecs, 
     collect({product: behavRec, score: 0.8, source: "behavioral"}) AS behavRecs
 
// Content: based on past purchases
OPTIONAL MATCH (me)-[:PURCHASED]->(:Product)-[:IN_CATEGORY]->(cat:Category)<-[:IN_CATEGORY]-(contentRec:Product)
WHERE NOT (me)-[:PURCHASED]->(contentRec)
WITH me, socialRecs + behavRecs + 
     collect({product: contentRec, score: 0.6, source: "content"}) AS allRecs
UNWIND allRecs AS rec
WHERE rec.product IS NOT NULL
WITH rec.product AS product, 
     sum(rec.score) AS totalScore,
     collect(rec.source) AS sources
RETURN product.name, totalScore, sources
ORDER BY totalScore DESC
LIMIT 20
 
// ========================================
// SESSION-BASED RECOMMENDATIONS
// ========================================
 
// "Based on your current session..."
WITH $sessionProducts AS viewedIds
MATCH (viewed:Product) WHERE viewed.id IN viewedIds
 
// Find products commonly viewed together in other sessions
MATCH (session:Session)-[:CONTAINED]->(viewed),
      (session)-[:CONTAINED]->(nextItem:Product)
WHERE NOT nextItem.id IN viewedIds
WITH nextItem, count(DISTINCT session) AS coViewCount
ORDER BY coViewCount DESC
LIMIT 10
RETURN nextItem.name, coViewCount
 
// ========================================
// PRE-COMPUTED SIMILARITY
// ========================================
 
// For production: compute similarity offline, query in real-time
// Offline job creates SIMILAR_TO relationships:
MATCH (p1:Product), (p2:Product)
WHERE p1 <> p2
MATCH (p1)-[:IN_CATEGORY]->(c:Category)<-[:IN_CATEGORY]-(p2)
MATCH (p1)<-[:PURCHASED]-(buyer:Customer)-[:PURCHASED]->(p2)
WITH p1, p2, count(DISTINCT c) AS catOverlap, count(DISTINCT buyer) AS buyerOverlap
WHERE buyerOverlap >= 10
MERGE (p1)-[s:SIMILAR_TO]-(p2)
SET s.score = catOverlap * 0.3 + buyerOverlap * 0.7,
    s.computedAt = datetime()
 
// Real-time query uses pre-computed edges:
MATCH (p:Product {id: $productId})-[s:SIMILAR_TO]-(rec:Product)
RETURN rec.name, s.score
ORDER BY s.score DESC
LIMIT 10

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

// ========================================
// ENTITY MODELING
// ========================================
 
// Create knowledge graph entities with rich typing
CREATE (einstein:Person:Scientist:Physicist {
    name: "Albert Einstein",
    birthDate: date("1879-03-14"),
    birthPlace: "Ulm, German Empire",
    knownFor: ["Theory of Relativity", "E=mc²", "Photoelectric Effect"]
})
 
CREATE (relativity:Theory:PhysicsTheory {
    name: "Theory of Relativity",
    published: date("1905-09-26"),
    type: "Special Relativity"
})
 
CREATE (nobelPhysics:Award:NobelPrize {
    name: "Nobel Prize in Physics",
    year: 1921,
    category: "Physics"
})
 
CREATE (eth:Institution:University {
    name: "ETH Zurich",
    location: "Zurich, Switzerland"
})
 
// Create relationships with context
CREATE (einstein)-[:FORMULATED {year: 1905, context: "annus mirabilis papers"}]->(relativity)
CREATE (einstein)-[:RECEIVED {year: 1921, citation: "photoelectric effect"}]->(nobelPhysics)
CREATE (einstein)-[:STUDIED_AT {from: 1896, to: 1900, degree: "diploma"}]->(eth)
CREATE (einstein)-[:WORKED_AT {from: 1912, to: 1914, role: "Professor"}]->(eth)
 
// ========================================
// KNOWLEDGE QUERIES
// ========================================
 
// Question: "Who developed the Theory of Relativity?"
MATCH (p:Person)-[:FORMULATED]->(t:Theory {name: "Theory of Relativity"})
RETURN p.name
 
// Question: "What awards did Einstein receive?"
MATCH (p:Person {name: "Albert Einstein"})-[r:RECEIVED]->(a:Award)
RETURN a.name, r.year, r.citation
 
// Question: "What other theories were developed at ETH Zurich?"
MATCH (p:Person)-[:STUDIED_AT|WORKED_AT]->(:Institution {name: "ETH Zurich"})
MATCH (p)-[:FORMULATED]->(theory:Theory)
RETURN DISTINCT theory.name, collect(p.name) AS developers
 
// ========================================
// INFERENCE AND REASONING
// ========================================
 
// Transitive relationships: advisors chain
MATCH path = (student:Person)-[:ADVISED_BY*]->(ancestor:Person)
WHERE student.name = "Current PhD Student"
RETURN [n IN nodes(path) | n.name] AS academicLineage,
       length(path) AS generations
 
// Type inference: derive is_a relationships
MATCH (e:Entity)
WHERE e:Scientist
MATCH (e)-[:WORKS_IN]->(field:Field)
SET e:Researcher
RETURN e.name, labels(e)
 
// Conflict detection: same entity, different facts
MATCH (e:Entity)-[r1]->(value1),
      (e)-[r2]->(value2)
WHERE type(r1) = type(r2) 
  AND value1 <> value2
  AND type(r1) IN ["BORN_IN", "DIED_IN"]
RETURN e.name, type(r1), value1, value2
 
// ========================================
// ENTITY RESOLUTION
// ========================================
 
// Find duplicate entities (same person, different nodes)
MATCH (e1:Person), (e2:Person)
WHERE id(e1) < id(e2)
  AND (e1.name = e2.name 
       OR (e1.birthDate = e2.birthDate AND e1.birthPlace = e2.birthPlace))
RETURN e1.name, e2.name, 
       CASE WHEN e1.name = e2.name THEN "name_match" ELSE "attribute_match" END AS matchType
 
// Create SAME_AS relationships for linked entities
MATCH (e1:Person), (e2:Person)
WHERE e1.externalId = e2.wikiDataId
MERGE (e1)-[:SAME_AS]-(e2)
 
// Query through SAME_AS for unified view
MATCH (e:Person {name: "Marie Curie"})-[:SAME_AS*0..1]-(alias)
WITH collect(DISTINCT e) + collect(DISTINCT alias) AS allRepresentations
UNWIND allRepresentations AS entity
MATCH (entity)-[r]->(related)
RETURN type(r) AS relationship, collect(DISTINCT related.name) AS relatedEntities
 
// ========================================
// SEMANTIC SEARCH
// ========================================
 
// Find entities by relationship context
MATCH (p:Person)-[:WON]->(:Award)<-[:WON]-(peer:Person),
      (p)-[:WORKED_IN]->(field:Field)<-[:WORKED_IN]-(peer)
WHERE p.name = "Richard Feynman"
  AND p <> peer
RETURN peer.name, field.name AS sharedField
 
// Path-based similarity
MATCH path = (e1:Concept {name: "Machine Learning"})-[:RELATED_TO*1..3]-(e2:Concept)
RETURN e2.name, length(path) AS distance
ORDER BY distance
LIMIT 10

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109

// ========================================
// DEPENDENCY MAPPING
// ========================================
 
// Model application dependencies
CREATE (frontend:Application {name: "Web Frontend", tier: "presentation"})
CREATE (api:Application {name: "API Gateway", tier: "application"})
CREATE (userSvc:Service {name: "UserService", tier: "service"})
CREATE (orderSvc:Service {name: "OrderService", tier: "service"})
CREATE (userDb:Database {name: "UserDB", type: "PostgreSQL"})
CREATE (orderDb:Database {name: "OrderDB", type: "PostgreSQL"})
CREATE (cache:Cache {name: "Redis", type: "Redis"})
 
CREATE (frontend)-[:CALLS]->(api)
CREATE (api)-[:CALLS]->(userSvc)
CREATE (api)-[:CALLS]->(orderSvc)
CREATE (userSvc)-[:USES]->(userDb)
CREATE (userSvc)-[:USES]->(cache)
CREATE (orderSvc)-[:USES]->(orderDb)
CREATE (orderSvc)-[:CALLS]->(userSvc)
 
// What does the frontend depend on (recursively)?
MATCH (frontend:Application {name: "Web Frontend"})-[:CALLS|USES*]->(dependency)
RETURN DISTINCT labels(dependency)[0] AS type, dependency.name AS name
 
// ========================================
// IMPACT ANALYSIS
// ========================================
 
// If UserDB goes down, what's affected?
MATCH (failedComponent {name: "UserDB"})
MATCH (failedComponent)<-[:USES|CALLS*]-(affected)
RETURN DISTINCT affected.name AS affectedComponent,
       labels(affected)[0] AS type,
       length(shortestPath((affected)-[:USES|CALLS*]->(failedComponent))) AS dependencyDepth
ORDER BY dependencyDepth
 
// Blast radius: count of affected components by tier
MATCH (failed:Database {name: "UserDB"})
MATCH (failed)<-[:USES|CALLS*]-(affected)
RETURN affected.tier AS tier, count(DISTINCT affected) AS affectedCount
ORDER BY affectedCount DESC
 
// Critical path: components with no redundancy
MATCH (client:Application)-[:CALLS]->(singleDep)-[:USES]->(resource),
      (singleDep)-[:USES]->(resource2)
WHERE NOT (client)-[:CALLS]->(:Service)<>singleDep-[:USES]->(resource)
RETURN client.name, singleDep.name AS singlePointOfFailure
 
// ========================================
// ROOT CAUSE ANALYSIS
// ========================================
 
// Trace error propagation path
WITH $errorServiceId AS errorOrigin
MATCH (origin {id: errorOrigin})
MATCH path = (origin)<-[:CALLS*1..10]-(caller)
WHERE ALL(node IN nodes(path) WHERE node.lastError IS NOT NULL)
RETURN [n IN nodes(path) | n.name] AS errorPropagationPath,
       [n IN nodes(path) | n.lastError] AS errors,
       origin.name AS rootCause
 
// Find correlated failures (likely common cause)
MATCH (f1:Component)-[:ERROR_AT {time: $errorTime}]->(:ErrorLog)
MATCH (f2:Component)-[:ERROR_AT {time: $errorTime}]->(:ErrorLog)
WHERE f1 <> f2
MATCH (f1)-[:DEPENDS_ON*1..3]->(common)<-[:DEPENDS_ON*1..3]-(f2)
RETURN common.name AS potentialRootCause,
       collect(DISTINCT f1.name) + collect(DISTINCT f2.name) AS affectedServices
 
// ========================================
// SECURITY - ACCESS PATH ANALYSIS
// ========================================
 
// Can this user access this resource? (RBAC path)
MATCH path = (user:User {email: $userEmail})-[:MEMBER_OF*0..3]->
             (:Group)-[:HAS_ROLE]->(:Role)-[:PERMITS]->
             (:Permission)-[:ON]->(resource:Resource {id: $resourceId})
RETURN count(path) > 0 AS hasAccess,
       [n IN nodes(path) | coalesce(n.name, n.email)] AS accessPath
 
// Attack surface: externally accessible paths to sensitive data
MATCH path = (external:ExternalEndpoint)-[:CONNECTS_TO*0..5]->(sensitive:DataStore)
WHERE sensitive.classification = "CONFIDENTIAL"
RETURN external.name AS entryPoint,
       [n IN nodes(path) | n.name] AS attackPath,
       length(path) AS hops
ORDER BY hops
 
// Find overprivileged users
MATCH (u:User)-[:MEMBER_OF*1..3]->(:Group)-[:HAS_ROLE]->(r:Role)-[:PERMITS]->(p:Permission)
WITH u, count(DISTINCT p) AS permCount, collect(p.name) AS permissions
WHERE permCount > 20
RETURN u.name, permCount, permissions[0..5] AS samplePermissions
ORDER BY permCount DESC
 
// ========================================
// CONFIGURATION DRIFT DETECTION
// ========================================
 
// Compare current vs baseline configuration
MATCH (current:Server)-[:HAS_CONFIG {version: "current"}]->(config:Config)
MATCH (baseline:Server)-[:HAS_CONFIG {version: "baseline"}]->(baseConfig:Config)
WHERE current.id = baseline.id
  AND config <> baseConfig
RETURN current.name AS server,
       config.setting AS currentSetting,
       baseConfig.setting AS baselineSetting,
       config.value <> baseConfig.value AS drifted

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

// ========================================
// SUPPLY CHAIN: Product Traceability
// ========================================
 
// Track ingredient from farm to product
MATCH path = (ingredient:Ingredient {batchId: $batchId})
              -[:SOURCED_FROM]->(supplier:Supplier)
              -[:LOCATED_IN]->(region:Region)
MATCH (ingredient)<-[:CONTAINS]-(product:Product)-[:SOLD_AT]->(store:Store)
RETURN ingredient.name, supplier.name, region.name,
       product.name, store.location
 
// Find all products affected by supplier recall
MATCH (recalled:Supplier {id: $recalledSupplierId})<-[:SOURCED_FROM*1..3]-(material)
MATCH (material)<-[:CONTAINS*]-(product:Product)
RETURN DISTINCT product.sku, product.name
 
// ========================================
// HEALTHCARE: Clinical Pathways
// ========================================
 
// Patient treatment journey
MATCH path = (patient:Patient {id: $patientId})
              -[:HAD_VISIT]->(visit:Visit)-[:DIAGNOSED_WITH]->(condition:Condition)
MATCH (visit)-[:PRESCRIBED]->(treatment:Treatment)
RETURN visit.date, condition.name, treatment.name
ORDER BY visit.date
 
// Treatment effectiveness by outcome paths
MATCH (treatment:Treatment {name: "Treatment A"})
      <-[:PRESCRIBED]-(visit:Visit)<-[:HAD_VISIT]-(patient:Patient)
      -[:HAD_OUTCOME]->(outcome:Outcome)
RETURN outcome.name, count(DISTINCT patient) AS patients
ORDER BY patients DESC
 
// ========================================
// LOGISTICS: Route Optimization
// ========================================
 
// Find optimal delivery route (TSP approximation)
MATCH (depot:Location {type: "WAREHOUSE"})
MATCH (stop:Location) WHERE stop.id IN $deliveryStops
WITH depot, collect(stop) AS stops
CALL gds.shortestPath.aStar.mutate('roadNetwork', {
    sourceNode: depot,
    relationshipWeightProperty: 'distance'
})
// Additional logic for multi-stop optimization...
RETURN *