-
Notifications
You must be signed in to change notification settings - Fork 42
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- addresses parts of #803 - update referenced schemas for SSVC
- Loading branch information
1 parent
f7fbb1f
commit 4a421c3
Showing
6 changed files
with
155 additions
and
46 deletions.
There are no files selected for viewing
125 changes: 125 additions & 0 deletions
125
csaf_2.1/referenced_schema/certcc/Decision_Point-1-0-1.schema.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,125 @@ | ||
| { | ||
| "$schema": "https://json-schema.org/draft/2020-12/schema", | ||
| "title": "Decision Point schema definition", | ||
| "$id": "https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json", | ||
| "description": "Decision points are the basic building blocks of SSVC decision functions. Individual decision points describe a single aspect of the input to a decision function.", | ||
| "$defs": { | ||
| "schemaVersion": { | ||
| "description": "Schema version used to represent this Decision Point.", | ||
| "type": "string", | ||
| "enum": [ | ||
| "1-0-1" | ||
| ] | ||
| }, | ||
| "decision_point_value": { | ||
| "type": "object", | ||
| "additionalProperties": false, | ||
| "properties": { | ||
| "key": { | ||
| "type": "string", | ||
| "description": "A short, unique string (or key) used as a shorthand identifier for a Decision Point Value.", | ||
| "minLength": 1, | ||
| "examples": [ | ||
| "P", | ||
| "Y" | ||
| ] | ||
| }, | ||
| "name": { | ||
| "type": "string", | ||
| "description": "A short label that identifies a Decision Point Value", | ||
| "minLength": 1, | ||
| "examples": [ | ||
| "Public PoC", | ||
| "Yes" | ||
| ] | ||
| }, | ||
| "description": { | ||
| "type": "string", | ||
| "description": "A full description of the Decision Point Value.", | ||
| "minLength": 1, | ||
| "examples": [ | ||
| "One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation.", | ||
| "Attackers can reliably automate steps 1-4 of the kill chain." | ||
| ] | ||
| } | ||
| }, | ||
| "required": [ | ||
| "key", | ||
| "name", | ||
| "description" | ||
| ] | ||
| }, | ||
| "decision_point": { | ||
| "type": "object", | ||
| "additionalProperties": false, | ||
| "properties": { | ||
| "schemaVersion": { | ||
| "$ref": "#/$defs/schemaVersion" | ||
| }, | ||
| "namespace": { | ||
| "type": "string", | ||
| "description": "Namespace (a short, unique string): For example, \"ssvc\" or \"cvss\" to indicate the source of the decision point. See SSVC Documentation for details.", | ||
| "pattern": "^[a-z0-9-]{3,4}[a-z0-9/\\.-]*$", | ||
| "examples": [ | ||
| "ssvc", | ||
| "cvss", | ||
| "ssvc-jp", | ||
| "ssvc/acme", | ||
| "ssvc/example.com" | ||
| ] | ||
| }, | ||
| "version": { | ||
| "type": "string", | ||
| "description": "Version (a semantic version string) that identifies the version of a Decision Point.", | ||
| "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$", | ||
| "examples": [ | ||
| "1.0.1", | ||
| "1.0.1-alpha" | ||
| ] | ||
| }, | ||
| "key": { | ||
| "type": "string", | ||
| "description": "A short, unique string (or key) used as a shorthand identifier for a Decision Point.", | ||
| "minLength": 1, | ||
| "examples": [ | ||
| "E", | ||
| "A" | ||
| ] | ||
| }, | ||
| "name": { | ||
| "type": "string", | ||
| "description": "A short label that identifies a Decision Point.", | ||
| "minLength": 1, | ||
| "examples": [ | ||
| "Exploitation", | ||
| "Automatable" | ||
| ] | ||
| }, | ||
| "description": { | ||
| "type": "string", | ||
| "description": "A full description of the Decision Point, explaining what it represents and how it is used in SSVC.", | ||
| "minLength": 1 | ||
| }, | ||
| "values": { | ||
| "description": "A set of possible answers for a given Decision Point", | ||
| "uniqueItems": true, | ||
| "type": "array", | ||
| "minItems": 1, | ||
| "items": { | ||
| "$ref": "#/$defs/decision_point_value" | ||
| } | ||
| } | ||
| }, | ||
| "required": [ | ||
| "namespace", | ||
| "version", | ||
| "key", | ||
| "name", | ||
| "description", | ||
| "values", | ||
| "schemaVersion" | ||
| ] | ||
| } | ||
| }, | ||
| "$ref": "#/$defs/decision_point" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters