@mitre/hdf-schema 3.6.0-rc.5 → 3.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/README.md +2 -2
  2. package/dist/go/hdf.go +10 -0
  3. package/dist/index.js +28 -28
  4. package/dist/schemas/hdf-amendments.schema.json +50 -66
  5. package/dist/schemas/hdf-baseline.schema.json +55 -71
  6. package/dist/schemas/hdf-comparison.schema.json +151 -173
  7. package/dist/schemas/hdf-evidence-package.schema.json +55 -72
  8. package/dist/schemas/hdf-plan.schema.json +56 -72
  9. package/dist/schemas/hdf-requirement-change-event.schema.json +141 -166
  10. package/dist/schemas/hdf-results.schema.json +126 -147
  11. package/dist/schemas/hdf-system.schema.json +73 -93
  12. package/dist/ts/hdf.d.ts +12 -0
  13. package/dist/ts/hdf.ts +12 -0
  14. package/package.json +2 -2
package/dist/schemas/hdf-comparison.schema.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-comparison/v3.5.0",
3
+ "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-comparison/v3.6.0",
4
4
  "type": "object",
5
5
  "unevaluatedProperties": false,
6
6
  "required": [
@@ -14,7 +14,7 @@
14
14
  "externalReferences": {
15
15
  "type": "array",
16
16
  "items": {
17
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"
17
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
18
18
  },
19
19
  "description": "Optional references to external artifacts relevant to this comparison (CTI/STIX, advisories, or any URI-addressable artifact). Inert context; see External_Reference."
20
20
  },
@@ -24,7 +24,7 @@
24
24
  "description": "Schema version for this comparison format."
25
25
  },
26
26
  "comparisonMode": {
27
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Comparison_Mode",
27
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Comparison_Mode",
28
28
  "description": "The mode of comparison being performed."
29
29
  },
30
30
  "timestamp": {
@@ -33,50 +33,50 @@
33
33
  "description": "When this comparison was performed."
34
34
  },
35
35
  "generator": {
36
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Generator",
36
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Generator",
37
37
  "description": "Information about the tool that generated this comparison."
38
38
  },
39
39
  "sources": {
40
40
  "type": "array",
41
41
  "minItems": 2,
42
42
  "items": {
43
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Source"
43
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Source"
44
44
  },
45
45
  "description": "The source documents being compared. At least two sources are required."
46
46
  },
47
47
  "matching": {
48
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Matching_Config",
48
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Matching_Config",
49
49
  "description": "Configuration for how requirements were matched across sources."
50
50
  },
51
51
  "summary": {
52
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Comparison_Summary",
52
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Comparison_Summary",
53
53
  "description": "Summary statistics for the overall comparison."
54
54
  },
55
55
  "baselineDiffs": {
56
56
  "type": "array",
57
57
  "items": {
58
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Baseline_Diff"
58
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Baseline_Diff"
59
59
  },
60
60
  "description": "Comparison of baselines between sources."
61
61
  },
62
62
  "requirementDiffs": {
63
63
  "type": "array",
64
64
  "items": {
65
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Requirement_Diff"
65
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Requirement_Diff"
66
66
  },
67
67
  "description": "Detailed comparison of individual requirements between sources."
68
68
  },
69
69
  "componentDiffs": {
70
70
  "type": "array",
71
71
  "items": {
72
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Component_Diff"
72
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Component_Diff"
73
73
  },
74
74
  "description": "Comparison of components between two system documents. Used in systemDrift mode. A component's BOM changes surface as a field change on its boms[] here."
75
75
  },
76
76
  "packageDiffs": {
77
77
  "type": "array",
78
78
  "items": {
79
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Package_Diff"
79
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Package_Diff"
80
80
  },
81
81
  "description": "RESERVED — not emitted by the current systemDrift comparison. systemDrift now reports a component's BOM changes as a field change on its boms[] (see componentDiffs), and standalone SBOM package diffing is a separate `hdf diff <sbom> <sbom>` output shape. This field is retained for a future normalized package-level diff; consumers must not expect it from today's systemDrift output."
82
82
  },
@@ -88,19 +88,19 @@
88
88
  "drift": {
89
89
  "type": "array",
90
90
  "items": {
91
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Requirement_Diff"
91
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Requirement_Diff"
92
92
  },
93
93
  "description": "External/metadata changes separate from status changes (Terraform pattern)."
94
94
  },
95
95
  "annotations": {
96
96
  "type": "object",
97
97
  "additionalProperties": {
98
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0#/$defs/Annotation"
98
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0#/$defs/Annotation"
99
99
  },
100
100
  "description": "Map of annotation IDs to annotation objects, providing context or action items for requirement diffs."
101
101
  },
102
102
  "integrity": {
103
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Integrity",
103
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Integrity",
104
104
  "description": "Cryptographic integrity information for verifying this comparison document."
105
105
  },
106
106
  "extensions": {
@@ -112,9 +112,9 @@
112
112
  "description": "Structured comparison between two or more HDF security assessment documents. Supports temporal, baseline, fleet, and multi-source comparison modes.",
113
113
  "title": "HDF Comparison",
114
114
  "$defs": {
115
- "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0": {
115
+ "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0": {
116
116
  "$schema": "https://json-schema.org/draft/2020-12/schema",
117
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0",
117
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0",
118
118
  "title": "HDF Common Primitives",
119
119
  "description": "Shared building blocks used by hdf-results and hdf-baseline schemas.",
120
120
  "$defs": {
@@ -194,22 +194,20 @@
194
194
  }
195
195
  },
196
196
  "unevaluatedProperties": false,
197
+ "$comment": "Examples, in order: 1) By-identity: cite a CVE by its id in the 'cve' system without a URL — equivalently urn:cve:CVE-2021-44228; 2) By-identity AND by-locator together (anyOf, not oneOf) — an ATT&CK technique cited by id with its canonical URL; 3) By-locator to a retrievable STIX bundle, with integrity hash, media type, and attribution; 4) Enrichment envelope: a STIX threat-intel object embedded losslessly in `document` and classified via `kind`, cited by id and pointed at by href — the pointer and the embedded copy compose. The payload rides verbatim; HDF does not normalize STIX fields.",
197
198
  "examples": [
198
199
  {
199
- "$comment": "By-identity: cite a CVE by its id in the 'cve' system without a URL — equivalently urn:cve:CVE-2021-44228.",
200
200
  "sourceName": "cve",
201
201
  "externalId": "CVE-2021-44228",
202
202
  "rel": "definition"
203
203
  },
204
204
  {
205
- "$comment": "By-identity AND by-locator together (anyOf, not oneOf) — an ATT&CK technique cited by id with its canonical URL.",
206
205
  "sourceName": "mitre-att&ck",
207
206
  "externalId": "T1059",
208
207
  "href": "https://attack.mitre.org/techniques/T1059/",
209
208
  "rel": "canonical"
210
209
  },
211
210
  {
212
- "$comment": "By-locator to a retrievable STIX bundle, with integrity hash, media type, and attribution.",
213
211
  "sourceName": "stix",
214
212
  "href": "https://cti.example.org/bundles/log4shell.json",
215
213
  "rel": "investigate",
@@ -225,7 +223,6 @@
225
223
  "addedAt": "2026-07-26T00:00:00Z"
226
224
  },
227
225
  {
228
- "$comment": "Enrichment envelope: a STIX threat-intel object embedded losslessly in `document` and classified via `kind`, cited by id and pointed at by href — the pointer and the embedded copy compose. The payload rides verbatim; HDF does not normalize STIX fields.",
229
226
  "sourceName": "stix",
230
227
  "externalId": "vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001",
231
228
  "href": "https://cti.example.org/bundles/log4shell.json#vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001",
@@ -1044,9 +1041,9 @@
1044
1041
  "description": "Whether the requirement is mandatory within its baseline.\n\nDistinct from severity (risk weight) and status (lifecycle state).\n\nMaps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).\n\nOptional: when omitted, consumers should treat the requirement as 'required' by convention."
1045
1042
  }
1046
1043
  },
1044
+ "$comment": "Examples, in order: 1) v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape under v3.6.0 (backward compatibility); 2) v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline; 3) v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement; 4) v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
1047
1045
  "examples": [
1048
1046
  {
1049
- "$comment": "v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape under v3.5.0 (backward compatibility).",
1050
1047
  "id": "SV-238196",
1051
1048
  "title": "The Ubuntu operating system must enforce password complexity",
1052
1049
  "impact": 0.5,
@@ -1076,7 +1073,6 @@
1076
1073
  ]
1077
1074
  },
1078
1075
  {
1079
- "$comment": "v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline.",
1080
1076
  "id": "AC-3",
1081
1077
  "title": "Access Enforcement",
1082
1078
  "impact": 0.7,
@@ -1098,7 +1094,6 @@
1098
1094
  "applicability": "required"
1099
1095
  },
1100
1096
  {
1101
- "$comment": "v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement.",
1102
1097
  "id": "KSI-CNA-01",
1103
1098
  "title": "Cyber Security Plan documents the system",
1104
1099
  "impact": 0.5,
@@ -1118,7 +1113,6 @@
1118
1113
  "applicability": "required"
1119
1114
  },
1120
1115
  {
1121
- "$comment": "v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
1122
1116
  "id": "SV-999999",
1123
1117
  "title": "Example STIG rule pending automation",
1124
1118
  "impact": 0.3,
@@ -1183,9 +1177,9 @@
1183
1177
  }
1184
1178
  }
1185
1179
  },
1186
- "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0": {
1180
+ "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0": {
1187
1181
  "$schema": "https://json-schema.org/draft/2020-12/schema",
1188
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.5.0",
1182
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/comparison/v3.6.0",
1189
1183
  "title": "HDF Comparison Primitives",
1190
1184
  "description": "Types for representing structured comparisons between HDF security assessment documents.",
1191
1185
  "$defs": {
@@ -1357,7 +1351,7 @@
1357
1351
  "description": "The original format of the source document before conversion to HDF."
1358
1352
  },
1359
1353
  "checksum": {
1360
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
1354
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
1361
1355
  "description": "Cryptographic checksum of the source document for integrity verification."
1362
1356
  },
1363
1357
  "assessmentTimestamp": {
@@ -1366,13 +1360,13 @@
1366
1360
  "description": "When the source assessment was performed. ISO 8601 format."
1367
1361
  },
1368
1362
  "tool": {
1369
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Tool",
1363
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Tool",
1370
1364
  "description": "The security tool that produced the assessment data in this source."
1371
1365
  },
1372
1366
  "components": {
1373
1367
  "type": "array",
1374
1368
  "items": {
1375
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"
1369
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0#/$defs/Component"
1376
1370
  },
1377
1371
  "description": "The components assessed in this source."
1378
1372
  },
@@ -1724,7 +1718,7 @@
1724
1718
  "before": {
1725
1719
  "oneOf": [
1726
1720
  {
1727
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"
1721
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0#/$defs/Component"
1728
1722
  },
1729
1723
  {
1730
1724
  "type": "null"
@@ -1735,7 +1729,7 @@
1735
1729
  "after": {
1736
1730
  "oneOf": [
1737
1731
  {
1738
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"
1732
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0#/$defs/Component"
1739
1733
  },
1740
1734
  {
1741
1735
  "type": "null"
@@ -1812,9 +1806,9 @@
1812
1806
  "description": "License identifiers for this package."
1813
1807
  }
1814
1808
  },
1809
+ "$comment": "Examples, in order: 1) Software package diff keyed by purl (the SBOM case); 2) AI-model node diff keyed by identifier when no purl applies.",
1815
1810
  "examples": [
1816
1811
  {
1817
- "$comment": "Software package diff keyed by purl (the SBOM case).",
1818
1812
  "purl": "pkg:npm/express@4.18.2",
1819
1813
  "name": "express",
1820
1814
  "state": "updated",
@@ -1822,7 +1816,6 @@
1822
1816
  "newVersion": "4.18.2"
1823
1817
  },
1824
1818
  {
1825
- "$comment": "AI-model node diff keyed by identifier when no purl applies.",
1826
1819
  "identifier": "acme/llama-2-7b-chat-support",
1827
1820
  "name": "Llama-2-7b-chat (finetuned)",
1828
1821
  "state": "added",
@@ -1941,7 +1934,7 @@
1941
1934
  "before": {
1942
1935
  "oneOf": [
1943
1936
  {
1944
- "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0#/$defs/Evaluated_Requirement"
1937
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0#/$defs/Evaluated_Requirement"
1945
1938
  },
1946
1939
  {
1947
1940
  "type": "null"
@@ -1952,7 +1945,7 @@
1952
1945
  "after": {
1953
1946
  "oneOf": [
1954
1947
  {
1955
- "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0#/$defs/Evaluated_Requirement"
1948
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0#/$defs/Evaluated_Requirement"
1956
1949
  },
1957
1950
  {
1958
1951
  "type": "null"
@@ -2048,9 +2041,9 @@
2048
2041
  }
2049
2042
  }
2050
2043
  },
2051
- "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0": {
2044
+ "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0": {
2052
2045
  "$schema": "https://json-schema.org/draft/2020-12/schema",
2053
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0",
2046
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0",
2054
2047
  "title": "HDF Extension Primitives",
2055
2048
  "description": "Extension types for waivers, attestations, generators, and integrity.",
2056
2049
  "$defs": {
@@ -2080,20 +2073,20 @@
2080
2073
  "externalReferences": {
2081
2074
  "type": "array",
2082
2075
  "items": {
2083
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"
2076
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
2084
2077
  },
2085
2078
  "description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object or CTI feed motivating an E:A riskAdjustment). Inert context distinct from `evidence`; see External_Reference. Symmetric with Standalone_Override.externalReferences for the inline (results-embedded) override carrier."
2086
2079
  },
2087
2080
  "type": {
2088
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Override_Type",
2081
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Override_Type",
2089
2082
  "description": "The type of override applied to this requirement."
2090
2083
  },
2091
2084
  "status": {
2092
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
2085
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
2093
2086
  "description": "The new status this override sets for the requirement. Optional when only impact is being overridden."
2094
2087
  },
2095
2088
  "impact": {
2096
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Impact_Override",
2089
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Impact_Override",
2097
2090
  "description": "Override to the requirement's impact score. At least one of status or impact must be set."
2098
2091
  },
2099
2092
  "reason": {
@@ -2101,7 +2094,7 @@
2101
2094
  "description": "Explanation for why this override was applied."
2102
2095
  },
2103
2096
  "appliedBy": {
2104
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
2097
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
2105
2098
  "description": "Identity of who applied this override. For simple cases, use type 'simple' with just an identifier."
2106
2099
  },
2107
2100
  "appliedAt": {
@@ -2115,30 +2108,31 @@
2115
2108
  "description": "Timestamp when this override expires and must be reviewed/renewed. REQUIRED - no permanent overrides allowed. ISO 8601 format."
2116
2109
  },
2117
2110
  "signature": {
2118
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature",
2111
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
2119
2112
  "description": "Optional digital signature for enhanced trust and non-repudiation. Supports hardware security tokens (PKCS#11/PKCS#12), Yubikeys, GPG keys, passkeys, and other signing methods."
2120
2113
  },
2121
2114
  "evidence": {
2122
2115
  "type": "array",
2123
2116
  "items": {
2124
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
2117
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
2125
2118
  },
2126
2119
  "description": "Supporting evidence for this override, such as screenshots demonstrating manual verification for attestations."
2127
2120
  },
2128
2121
  "previousChecksum": {
2129
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
2122
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
2130
2123
  "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
2131
2124
  },
2132
2125
  "cvss": {
2133
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
2126
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0#/$defs/Cvss",
2134
2127
  "$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
2135
2128
  "description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
2136
2129
  },
2137
2130
  "justification": {
2138
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Justification",
2131
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Justification",
2139
2132
  "description": "Structured controlled-vocabulary classification for why this override applies. Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive and attestation overrides where the structured category enables filtering and lossless round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the precedent vocabulary and rationale."
2140
2133
  }
2141
2134
  },
2135
+ "$comment": "Example 3: Inline riskAdjustment carrying the STIX source that motivated it via externalReferences (the enrichment envelope, with the raw sighting embedded losslessly in document). This is the shape the enrich pass writes onto Evaluated_Requirement.overrides[] for the E:A recompute.",
2142
2136
  "examples": [
2143
2137
  {
2144
2138
  "type": "waiver",
@@ -2165,7 +2159,6 @@
2165
2159
  "expiresAt": "2026-10-14T00:00:00Z"
2166
2160
  },
2167
2161
  {
2168
- "$comment": "Inline riskAdjustment carrying the STIX source that motivated it via externalReferences (the enrichment envelope, with the raw sighting embedded losslessly in document). This is the shape the enrich pass writes onto Evaluated_Requirement.overrides[] for the E:A recompute.",
2169
2162
  "type": "riskAdjustment",
2170
2163
  "impact": {
2171
2164
  "value": 0.9
@@ -2271,7 +2264,7 @@
2271
2264
  "description": "Detailed explanation of the plan, including what actions will be taken."
2272
2265
  },
2273
2266
  "appliedBy": {
2274
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
2267
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
2275
2268
  "description": "Identity of who created this POA&M. For simple cases, use type 'simple' with just an identifier."
2276
2269
  },
2277
2270
  "appliedAt": {
@@ -2287,23 +2280,23 @@
2287
2280
  "milestones": {
2288
2281
  "type": "array",
2289
2282
  "items": {
2290
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Milestone"
2283
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Milestone"
2291
2284
  },
2292
2285
  "description": "Optional array of milestones tracking progress toward completion."
2293
2286
  },
2294
2287
  "signature": {
2295
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature",
2288
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
2296
2289
  "description": "Optional digital signature for enhanced trust and non-repudiation."
2297
2290
  },
2298
2291
  "evidence": {
2299
2292
  "type": "array",
2300
2293
  "items": {
2301
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
2294
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
2302
2295
  },
2303
2296
  "description": "Supporting evidence for this POA&M, such as documentation of compensating controls or mitigation implementation."
2304
2297
  },
2305
2298
  "previousChecksum": {
2306
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
2299
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
2307
2300
  "description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
2308
2301
  }
2309
2302
  },
@@ -2456,7 +2449,7 @@
2456
2449
  },
2457
2450
  "properties": {
2458
2451
  "algorithm": {
2459
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Hash_Algorithm",
2452
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Hash_Algorithm",
2460
2453
  "description": "The hash algorithm used for the checksum."
2461
2454
  },
2462
2455
  "checksum": {
@@ -2489,9 +2482,9 @@
2489
2482
  }
2490
2483
  }
2491
2484
  },
2492
- "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0": {
2485
+ "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0": {
2493
2486
  "$schema": "https://json-schema.org/draft/2020-12/schema",
2494
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0",
2487
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0",
2495
2488
  "title": "HDF Amendment Primitives",
2496
2489
  "description": "Types for waivers, attestations, and POA&Ms that modify requirement compliance status.",
2497
2490
  "$defs": {
@@ -2602,7 +2595,7 @@
2602
2595
  "externalReferences": {
2603
2596
  "type": "array",
2604
2597
  "items": {
2605
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"
2598
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
2606
2599
  },
2607
2600
  "description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object, advisory, or CTI feed that motivated it). Inert context distinct from `evidence`; see External_Reference."
2608
2601
  },
@@ -2619,7 +2612,7 @@
2619
2612
  "description": "Name of the baseline containing the requirement. Required when the system has multiple baselines with potentially overlapping requirement IDs."
2620
2613
  },
2621
2614
  "status": {
2622
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
2615
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
2623
2616
  "description": "The new status this amendment sets. Optional when only impact is being overridden."
2624
2617
  },
2625
2618
  "impact": {
@@ -2631,7 +2624,7 @@
2631
2624
  "description": "Justification for this amendment."
2632
2625
  },
2633
2626
  "appliedBy": {
2634
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
2627
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
2635
2628
  "description": "Identity of who applied this amendment."
2636
2629
  },
2637
2630
  "appliedAt": {
@@ -2647,20 +2640,20 @@
2647
2640
  "evidence": {
2648
2641
  "type": "array",
2649
2642
  "items": {
2650
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
2643
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
2651
2644
  },
2652
2645
  "description": "Supporting evidence (screenshots, logs, URLs, documents)."
2653
2646
  },
2654
2647
  "signature": {
2655
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Signature",
2648
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Signature",
2656
2649
  "description": "Digital signature for non-repudiation."
2657
2650
  },
2658
2651
  "previousChecksum": {
2659
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
2652
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
2660
2653
  "description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
2661
2654
  },
2662
2655
  "cvss": {
2663
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss",
2656
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0#/$defs/Cvss",
2664
2657
  "$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
2665
2658
  "description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
2666
2659
  },
@@ -2671,7 +2664,7 @@
2671
2664
  "milestones": {
2672
2665
  "type": "array",
2673
2666
  "items": {
2674
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Milestone"
2667
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Milestone"
2675
2668
  },
2676
2669
  "description": "Remediation milestones (primarily for POA&M type amendments)."
2677
2670
  },
@@ -2688,11 +2681,12 @@
2688
2681
  "affectedPackages": {
2689
2682
  "type": "array",
2690
2683
  "items": {
2691
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0#/$defs/Affected_Package"
2684
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0#/$defs/Affected_Package"
2692
2685
  },
2693
2686
  "description": "Software packages this amendment is scoped to, distinct from componentRef (which scopes to an HDF-internal Component by UUID).\n\nUse when the source amendment format references packages by purl/cpe/name+version — e.g., VEX `affects[]` / `products[]`, OSCAL POA&M `subjects[]`, FedRAMP component-aware amendments.\n\nSymmetric with Evaluated_Requirement.affectedPackages, which scopes findings to the same package vocabulary.\n\nWhen omitted, the amendment applies system-wide (or only to componentRef when that is set)."
2694
2687
  }
2695
2688
  },
2689
+ "$comment": "Example 7: VEX-style import — falsePositive scoped to specific packages by purl. The affectedPackages array carries structured product identity instead of squeezing 'Products: …' into the reason free-text field.",
2696
2690
  "examples": [
2697
2691
  {
2698
2692
  "type": "waiver",
@@ -2794,7 +2788,6 @@
2794
2788
  "expiresAt": "2026-09-26T00:00:00Z"
2795
2789
  },
2796
2790
  {
2797
- "$comment": "VEX-style import — falsePositive scoped to specific packages by purl. The affectedPackages array carries structured product identity instead of squeezing 'Products: …' into the reason free-text field.",
2798
2791
  "type": "falsePositive",
2799
2792
  "requirementId": "CVE-2026-12345",
2800
2793
  "status": "notApplicable",
@@ -2821,9 +2814,9 @@
2821
2814
  }
2822
2815
  }
2823
2816
  },
2824
- "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0": {
2817
+ "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0": {
2825
2818
  "$schema": "https://json-schema.org/draft/2020-12/schema",
2826
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0",
2819
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0",
2827
2820
  "title": "HDF Result Primitives",
2828
2821
  "description": "Types for representing assessment results and statuses.",
2829
2822
  "$defs": {
@@ -2954,9 +2947,9 @@
2954
2947
  }
2955
2948
  }
2956
2949
  },
2957
- "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0": {
2950
+ "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0": {
2958
2951
  "$schema": "https://json-schema.org/draft/2020-12/schema",
2959
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0",
2952
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0",
2960
2953
  "title": "HDF CVSS Primitives",
2961
2954
  "description": "Types for representing CVSS (Common Vulnerability Scoring System) data attached to assessment findings. Supports CVSS v2.0, v3.0, v3.1, and v4.0 metric groups (Base, Threat, Environmental, Supplemental).",
2962
2955
  "$defs": {
@@ -3020,7 +3013,7 @@
3020
3013
  ]
3021
3014
  }
3022
3015
  ],
3023
- "$comment": "Only `version` is required; every metric/score field is optional because a single Cvss instance may represent vendor-supplied Base data (on a finding's cvss[]), consumer-supplied enrichment (on a riskAdjustment override — Environmental/Threat/Supplemental deltas with NO base, since base is the finding's scan-specific vendor data), or a fully-resolved effectiveCvss. The Base/Threat/Environmental/Supplemental groups do not partition cleanly into vendor-vs-consumer (Threat straddles: vendor temporal data and consumer exploit-maturity both live here), so a single permissive type is more honest than separate vendor/consumer types. The anyOf guardrail rejects a content-free object (e.g. {version} alone) by requiring at least one substantive metric or score. baseVector remains optional even when baseScore is present: some vendor tools (Twistlock/Prisma Cloud) emit a final score without the vector that derived it — that score is captured structurally rather than lost.",
3016
+ "$comment": "Only `version` is required; every metric/score field is optional because a single Cvss instance may represent vendor-supplied Base data (on a finding's cvss[]), consumer-supplied enrichment (on a riskAdjustment override — Environmental/Threat/Supplemental deltas with NO base, since base is the finding's scan-specific vendor data), or a fully-resolved effectiveCvss. The Base/Threat/Environmental/Supplemental groups do not partition cleanly into vendor-vs-consumer (Threat straddles: vendor temporal data and consumer exploit-maturity both live here), so a single permissive type is more honest than separate vendor/consumer types. The anyOf guardrail rejects a content-free object (e.g. {version} alone) by requiring at least one substantive metric or score. baseVector remains optional even when baseScore is present: some vendor tools (Twistlock/Prisma Cloud) emit a final score without the vector that derived it — that score is captured structurally rather than lost. Examples, in order: 1) Base-only: vendor-supplied CVSS 3.1 data exactly as a scanner (e.g., Nessus, Grype) would emit it. No consumer enrichment yet; 2) Base + Threat: consumer added Exploit Maturity ('E:U' = Unproven) and Remediation Level ('RL:O' = Official Fix) to a HTTP/2 'Rapid Reset' DoS finding. Threat score drops from base 7.5 to 5.5; 3) Base + Environmental: consumer asserts the affected system is high-criticality (CR:H, IR:H, AR:H) AND network-reachable in their environment (MAV:N). Environmental score reflects deployment risk for the xz-utils backdoor; 4) Full CVSS 4.0: vendor base + consumer threat (E:A = Attacked, exploits seen in the wild) + environmental (high CIA requirements) + supplemental context (S:P = present safety impact, AU:N = no autonomous spread, RE:M = moderate response effort) for the Fortinet FortiOS pre-auth RCE. computedScore reflects post-mitigation final risk; 5) CVSS 2.0 legacy: Heartbleed (CVE-2014-0160) as still reported by older scanner output and legacy NVD data. CVSS 2.0 vectors have no 'CVSS:2.0/' prefix.",
3024
3017
  "properties": {
3025
3018
  "version": {
3026
3019
  "type": "string",
@@ -3100,7 +3093,6 @@
3100
3093
  },
3101
3094
  "examples": [
3102
3095
  {
3103
- "$comment": "Base-only: vendor-supplied CVSS 3.1 data exactly as a scanner (e.g., Nessus, Grype) would emit it. No consumer enrichment yet.",
3104
3096
  "version": "3.1",
3105
3097
  "source": "CVE-2024-12345",
3106
3098
  "baseVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
@@ -3108,7 +3100,6 @@
3108
3100
  "baseSeverity": "critical"
3109
3101
  },
3110
3102
  {
3111
- "$comment": "Base + Threat: consumer added Exploit Maturity ('E:U' = Unproven) and Remediation Level ('RL:O' = Official Fix) to a HTTP/2 'Rapid Reset' DoS finding. Threat score drops from base 7.5 to 5.5.",
3112
3103
  "version": "3.1",
3113
3104
  "source": "CVE-2023-44487",
3114
3105
  "baseVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
@@ -3118,7 +3109,6 @@
3118
3109
  "threatScore": 5.5
3119
3110
  },
3120
3111
  {
3121
- "$comment": "Base + Environmental: consumer asserts the affected system is high-criticality (CR:H, IR:H, AR:H) AND network-reachable in their environment (MAV:N). Environmental score reflects deployment risk for the xz-utils backdoor.",
3122
3112
  "version": "3.1",
3123
3113
  "source": "CVE-2024-3094",
3124
3114
  "baseVector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
@@ -3130,7 +3120,6 @@
3130
3120
  "computedSeverity": "critical"
3131
3121
  },
3132
3122
  {
3133
- "$comment": "Full CVSS 4.0: vendor base + consumer threat (E:A = Attacked, exploits seen in the wild) + environmental (high CIA requirements) + supplemental context (S:P = present safety impact, AU:N = no autonomous spread, RE:M = moderate response effort) for the Fortinet FortiOS pre-auth RCE. computedScore reflects post-mitigation final risk.",
3134
3123
  "version": "4.0",
3135
3124
  "source": "CVE-2024-21762",
3136
3125
  "baseVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
@@ -3145,7 +3134,6 @@
3145
3134
  "computedSeverity": "medium"
3146
3135
  },
3147
3136
  {
3148
- "$comment": "CVSS 2.0 legacy: Heartbleed (CVE-2014-0160) as still reported by older scanner output and legacy NVD data. CVSS 2.0 vectors have no 'CVSS:2.0/' prefix.",
3149
3137
  "version": "2.0",
3150
3138
  "source": "CVE-2014-0160",
3151
3139
  "baseVector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
@@ -3158,9 +3146,9 @@
3158
3146
  }
3159
3147
  }
3160
3148
  },
3161
- "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0": {
3149
+ "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0": {
3162
3150
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3163
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0",
3151
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0",
3164
3152
  "title": "HDF Affected Package Primitives",
3165
3153
  "description": "Types for representing the software package(s) affected by a vulnerability finding.",
3166
3154
  "$defs": {
@@ -3226,9 +3214,9 @@
3226
3214
  "description": "Optional version string identifying the first release that contains the fix for the vulnerability. Use the same version syntax as `version`. Example: '1.1.1l' fixes 'openssl@1.1.1k'."
3227
3215
  }
3228
3216
  },
3217
+ "$comment": "Examples, in order: 1) RPM ecosystem with full CPE + PURL — typical Grype/Trivy output for a RHEL host scan; 2) NPM ecosystem with PURL only — the JavaScript world rarely emits CPEs; PURL is the canonical identifier; 3) Minimal valid AffectedPackage — only the three required fields. Use when the scanner reports a package by name+version without emitting CPE or PURL strings; 4) Maven ecosystem with full identifiers + fixedInVersion — log4j Log4Shell-style finding showing the patch path from vulnerable to fixed; 5) purl-only — VEX import path where the source format gives a purl and we choose not to decompose it. Valid because purl encodes name/version/ecosystem implicitly; 6) cpe-only — NIST-flavored scopes where the consumer carries a CPE 2.3 string and no purl. Valid because cpe encodes vendor/product/version.",
3229
3218
  "examples": [
3230
3219
  {
3231
- "$comment": "RPM ecosystem with full CPE + PURL — typical Grype/Trivy output for a RHEL host scan.",
3232
3220
  "name": "openssl",
3233
3221
  "version": "1.1.1k-7.el8_4",
3234
3222
  "ecosystem": "rpm",
@@ -3237,7 +3225,6 @@
3237
3225
  "fixedInVersion": "1.1.1l"
3238
3226
  },
3239
3227
  {
3240
- "$comment": "NPM ecosystem with PURL only — the JavaScript world rarely emits CPEs; PURL is the canonical identifier.",
3241
3228
  "name": "lodash",
3242
3229
  "version": "4.17.20",
3243
3230
  "ecosystem": "npm",
@@ -3245,13 +3232,11 @@
3245
3232
  "fixedInVersion": "4.17.21"
3246
3233
  },
3247
3234
  {
3248
- "$comment": "Minimal valid AffectedPackage — only the three required fields. Use when the scanner reports a package by name+version without emitting CPE or PURL strings.",
3249
3235
  "name": "requests",
3250
3236
  "version": "2.28.1",
3251
3237
  "ecosystem": "pypi"
3252
3238
  },
3253
3239
  {
3254
- "$comment": "Maven ecosystem with full identifiers + fixedInVersion — log4j Log4Shell-style finding showing the patch path from vulnerable to fixed.",
3255
3240
  "name": "org.apache.logging.log4j:log4j-core",
3256
3241
  "version": "2.14.1",
3257
3242
  "ecosystem": "maven",
@@ -3260,11 +3245,9 @@
3260
3245
  "fixedInVersion": "2.17.1"
3261
3246
  },
3262
3247
  {
3263
- "$comment": "purl-only — VEX import path where the source format gives a purl and we choose not to decompose it. Valid because purl encodes name/version/ecosystem implicitly.",
3264
3248
  "purl": "pkg:npm/lodash@4.17.20"
3265
3249
  },
3266
3250
  {
3267
- "$comment": "cpe-only — NIST-flavored scopes where the consumer carries a CPE 2.3 string and no purl. Valid because cpe encodes vendor/product/version.",
3268
3251
  "cpe": "cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*"
3269
3252
  }
3270
3253
  ],
@@ -3273,9 +3256,9 @@
3273
3256
  }
3274
3257
  }
3275
3258
  },
3276
- "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0": {
3259
+ "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0": {
3277
3260
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3278
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0",
3261
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0",
3279
3262
  "title": "HDF Component Primitives",
3280
3263
  "description": "First-class system component with identity, polymorphic type, generalized BOM attachment (boms[]), and system-binding properties. Components are the successor to Targets, adding stable identity (componentId), external system cross-references, and manifest inventory (SBOM, AI model/dataset, and reserved future BOM kinds).",
3281
3264
  "$defs": {
@@ -3321,7 +3304,7 @@
3321
3304
  "description": "Description of this component's role or purpose."
3322
3305
  },
3323
3306
  "owner": {
3324
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
3307
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
3325
3308
  "description": "Team or individual responsible for this component. Enables per-component ownership when different teams manage different parts of a system."
3326
3309
  },
3327
3310
  "externalIds": {
@@ -3341,14 +3324,14 @@
3341
3324
  "boms": {
3342
3325
  "type": "array",
3343
3326
  "items": {
3344
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.5.0#/$defs/Bom"
3327
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.6.0#/$defs/Bom"
3345
3328
  },
3346
3329
  "description": "Component-scoped Bills of Materials (SBOM, ai-model, dataset, or any reserved bomType), each carried by passthrough (ref/document) or normalized. Replaces the former sbom/sbomRef/sbomFormat trio; a component may carry several BOMs (e.g. an SBOM plus an ai-model BOM). See primitives/bom.schema.json."
3347
3330
  },
3348
3331
  "integrity": {
3349
3332
  "type": "array",
3350
3333
  "items": {
3351
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum"
3334
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum"
3352
3335
  },
3353
3336
  "description": "Cryptographic integrity of this component's underlying artifact — model weights or shards, dataset archive, container image, or package bytes.\n\nAn array supports multi-file/sharded artifacts.\n\nThis is the single, generic home for artifact/subject integrity across all component types (it replaced the former per-type Container_Image digest and Artifact checksum fields).\n\nDistinct from BOM-document integrity (Bom.hashes[]) and from the document tamper-evidence Integrity type."
3354
3337
  },
@@ -3362,12 +3345,12 @@
3362
3345
  "inputOverrides": {
3363
3346
  "type": "array",
3364
3347
  "items": {
3365
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0#/$defs/Input_Override"
3348
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0#/$defs/Input_Override"
3366
3349
  },
3367
3350
  "description": "System-specific overrides for baseline input values."
3368
3351
  },
3369
3352
  "targetSelector": {
3370
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0#/$defs/Target_Selector",
3353
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0#/$defs/Target_Selector",
3371
3354
  "description": "Label selector to match targets belonging to this component during migration. Targets with matching labels are automatically included."
3372
3355
  }
3373
3356
  },
@@ -3498,9 +3481,9 @@
3498
3481
  }
3499
3482
  }
3500
3483
  ],
3484
+ "$comment": "Examples, in order: 1) Domain-joined host carrying all three identity fields separately: short hostname, FQDN, and the (distinct) directory domain. HOST_NAME and HOST_FQDN from a STIG checklist map here; note the AD domain differs from the FQDN's DNS suffix; 2) Standalone/workgroup host: has a short hostname but no directory domain — 'domain' is omitted rather than fabricated from the FQDN suffix.",
3501
3485
  "examples": [
3502
3486
  {
3503
- "$comment": "Domain-joined host carrying all three identity fields separately: short hostname, FQDN, and the (distinct) directory domain. HOST_NAME and HOST_FQDN from a STIG checklist map here; note the AD domain differs from the FQDN's DNS suffix.",
3504
3487
  "type": "host",
3505
3488
  "name": "web-server-prod-01",
3506
3489
  "componentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
@@ -3516,7 +3499,6 @@
3516
3499
  }
3517
3500
  },
3518
3501
  {
3519
- "$comment": "Standalone/workgroup host: has a short hostname but no directory domain — 'domain' is omitted rather than fabricated from the FQDN suffix.",
3520
3502
  "type": "host",
3521
3503
  "name": "kiosk-lab-07",
3522
3504
  "hostname": "kiosk-lab-07",
@@ -3651,7 +3633,7 @@
3651
3633
  "const": "cloudAccount"
3652
3634
  },
3653
3635
  "provider": {
3654
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Cloud_Provider",
3636
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Cloud_Provider",
3655
3637
  "description": "Cloud provider."
3656
3638
  },
3657
3639
  "accountId": {
@@ -3690,7 +3672,7 @@
3690
3672
  "const": "cloudResource"
3691
3673
  },
3692
3674
  "provider": {
3693
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Cloud_Provider",
3675
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Cloud_Provider",
3694
3676
  "description": "Cloud provider."
3695
3677
  },
3696
3678
  "resourceType": {
@@ -3989,9 +3971,9 @@
3989
3971
  }
3990
3972
  }
3991
3973
  },
3992
- "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.5.0": {
3974
+ "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.6.0": {
3993
3975
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3994
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.5.0",
3976
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.6.0",
3995
3977
  "title": "HDF BOM Primitives",
3996
3978
  "description": "Generalized Bill-of-Materials / manifest representation.\n\nOne extensible Bom shape, discriminated by bomType, carries any manifest kind (SBOM, AI model/dataset, and reserved future kinds) either by passthrough (opaque ref/embed of the native document) or normalized (converted into HDF's queryable shape).\n\nSubject identity (name, version, componentId) is inherited from the host component or system — the BOM never re-owns it.\n\nSee ADR-0001.",
3997
3979
  "$defs": {
@@ -4047,7 +4029,7 @@
4047
4029
  "hashes": {
4048
4030
  "type": "array",
4049
4031
  "items": {
4050
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum"
4032
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum"
4051
4033
  },
4052
4034
  "description": "Integrity of the carried BOM *document* itself (the referenced/embedded manifest file), NOT the integrity of the BOM's subject artifact. Subject/artifact integrity (model weights, dataset archive) is a component-level concern, not carried here. Subject identity is inherited from the host component/system; per-node identity lives in the type-extension."
4053
4035
  },
@@ -4164,9 +4146,9 @@
4164
4146
  ]
4165
4147
  }
4166
4148
  ],
4149
+ "$comment": "Examples, in order: 1) Passthrough SBOM by external reference — the universal escape hatch, available to every bomType; 2) Passthrough for a reserved-but-not-yet-normalized type (cbom) — carried opaquely until a normalized extension ships; 3) Normalized ai-model BOM: CISA/G7-aligned fields live in the model extension, never at the component root or shared base; 4) Normalized dataset BOM with lineage — a filtered derivative of a base dataset, referenced by an ai-model via datasetRefs.",
4167
4150
  "examples": [
4168
4151
  {
4169
- "$comment": "Passthrough SBOM by external reference — the universal escape hatch, available to every bomType.",
4170
4152
  "bomType": "sbom",
4171
4153
  "format": "cyclonedx",
4172
4154
  "ref": "https://artifacts.agency.gov/sbom/webtier.cdx.json",
@@ -4178,7 +4160,6 @@
4178
4160
  ]
4179
4161
  },
4180
4162
  {
4181
- "$comment": "Passthrough for a reserved-but-not-yet-normalized type (cbom) — carried opaquely until a normalized extension ships.",
4182
4163
  "bomType": "cbom",
4183
4164
  "format": "cyclonedx",
4184
4165
  "document": {
@@ -4187,7 +4168,6 @@
4187
4168
  }
4188
4169
  },
4189
4170
  {
4190
- "$comment": "Normalized ai-model BOM: CISA/G7-aligned fields live in the model extension, never at the component root or shared base.",
4191
4171
  "bomType": "ai-model",
4192
4172
  "format": "cyclonedx-ml",
4193
4173
  "model": {
@@ -4227,7 +4207,6 @@
4227
4207
  }
4228
4208
  },
4229
4209
  {
4230
- "$comment": "Normalized dataset BOM with lineage — a filtered derivative of a base dataset, referenced by an ai-model via datasetRefs.",
4231
4210
  "bomType": "dataset",
4232
4211
  "format": "croissant",
4233
4212
  "dataset": {
@@ -4462,9 +4441,9 @@
4462
4441
  }
4463
4442
  }
4464
4443
  },
4465
- "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0": {
4444
+ "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0": {
4466
4445
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4467
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.5.0",
4446
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.6.0",
4468
4447
  "title": "HDF System Primitives",
4469
4448
  "description": "Types for describing system architecture, authorization boundaries, and components.",
4470
4449
  "$defs": {
@@ -4515,7 +4494,7 @@
4515
4494
  "description": "Rationale for why this override is needed."
4516
4495
  },
4517
4496
  "approvedBy": {
4518
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
4497
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
4519
4498
  "description": "Identity of the person or system that approved this override."
4520
4499
  }
4521
4500
  },
@@ -4597,9 +4576,9 @@
4597
4576
  }
4598
4577
  }
4599
4578
  },
4600
- "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0": {
4579
+ "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0": {
4601
4580
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4602
- "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.5.0",
4581
+ "$id": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.6.0",
4603
4582
  "type": "object",
4604
4583
  "unevaluatedProperties": false,
4605
4584
  "required": [
@@ -4609,7 +4588,7 @@
4609
4588
  "externalReferences": {
4610
4589
  "type": "array",
4611
4590
  "items": {
4612
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/External_Reference"
4591
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/External_Reference"
4613
4592
  },
4614
4593
  "description": "Optional references to external artifacts (CTI/STIX, BOMs, advisories, runbooks, or any URI-addressable artifact) relevant to this assessment as a whole. Inert context; see External_Reference."
4615
4594
  },
@@ -4626,7 +4605,7 @@
4626
4605
  "components": {
4627
4606
  "type": "array",
4628
4607
  "items": {
4629
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.5.0#/$defs/Component"
4608
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.6.0#/$defs/Component"
4630
4609
  },
4631
4610
  "description": "The components that were assessed. Each component describes a system element (host, container, cloud resource, application, etc.) with optional identity, SBOM, and external references."
4632
4611
  },
@@ -4638,27 +4617,38 @@
4638
4617
  "description": "Information on the baselines that were evaluated, including findings."
4639
4618
  },
4640
4619
  "statistics": {
4641
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.5.0#/$defs/Statistics",
4620
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.6.0#/$defs/Statistics",
4642
4621
  "description": "Statistics for the assessment run, including duration and result counts."
4643
4622
  },
4644
4623
  "generator": {
4645
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Generator",
4624
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Generator",
4646
4625
  "description": "Information about the tool that generated this file."
4647
4626
  },
4648
4627
  "tool": {
4649
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Tool",
4628
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Tool",
4650
4629
  "description": "The security tool that produced the assessment data in this file."
4651
4630
  },
4652
4631
  "integrity": {
4653
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Integrity",
4632
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Integrity",
4654
4633
  "description": "Cryptographic integrity information for verifying this file."
4655
4634
  },
4635
+ "preAmendmentChecksum": {
4636
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
4637
+ "description": "Hash of this results document as it stood immediately before the most recent amendment application. Written by `hdf amend apply` when it applies at least one override; an apply that matches nothing leaves the document untouched. The hash covers the results file's RAW BYTES as read, not a canonical form, so reproducing it requires the byte-identical original — reformatting or re-serializing the source changes the value. Only the most recent pre-application state is recorded: applying amendments to an already-amended document REPLACES this value, so it is a single link back one step, not a growing chain. Distinct from the `previousChecksum` inside an override, which chains amendments to each other and is computed over a canonical JSON form.",
4638
+ "$comment": "Example 1: the real SHA-256 of hdf-converters/converters/nessus-to-hdf/fixtures/expected/sample.nessus.hdf.json, reproducible with `shasum -a 256` on that file — chosen over a synthetic digest so a reader can verify the hash basis is the raw file bytes.",
4639
+ "examples": [
4640
+ {
4641
+ "algorithm": "sha256",
4642
+ "value": "9599ce7889e99b70ef5d0f3efa4215e35059c10a7e89b9314cbf4ded8fdbad38"
4643
+ }
4644
+ ]
4645
+ },
4656
4646
  "runner": {
4657
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.5.0#/$defs/Runner",
4647
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.6.0#/$defs/Runner",
4658
4648
  "description": "Information about the test execution environment where the security tool was run. Distinct from targets (what is being tested)."
4659
4649
  },
4660
4650
  "remediation": {
4661
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Remediation",
4651
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Remediation",
4662
4652
  "description": "Optional reference to automated remediation resources (Ansible playbooks, Terraform scripts, etc.) for fixing failing requirements found in this assessment."
4663
4653
  },
4664
4654
  "systemRef": {
@@ -4672,7 +4662,7 @@
4672
4662
  "description": "Reference to an hdf-plan document describing the assessment plan that produced these results. May be a relative path, absolute URI, or fragment identifier."
4673
4663
  },
4674
4664
  "derivation": {
4675
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0#/$defs/Derivation",
4665
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0#/$defs/Derivation",
4676
4666
  "description": "Present ONLY on reconciled result sets: lineage recording the seed snapshot and event watermark this document was reassembled from (ADR-0005). Documents produced directly by a scan omit this field. When present, generator names the reconciling tool."
4677
4667
  },
4678
4668
  "extensions": {
@@ -4770,14 +4760,14 @@
4770
4760
  ],
4771
4761
  "allOf": [
4772
4762
  {
4773
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Baseline_Metadata"
4763
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Baseline_Metadata"
4774
4764
  }
4775
4765
  ],
4776
4766
  "properties": {
4777
4767
  "depends": {
4778
4768
  "type": "array",
4779
4769
  "items": {
4780
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Dependency"
4770
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Dependency"
4781
4771
  },
4782
4772
  "description": "The set of dependencies this baseline depends on."
4783
4773
  },
@@ -4790,15 +4780,15 @@
4790
4780
  "description": "The description - should be more detailed than the summary."
4791
4781
  },
4792
4782
  "integrity": {
4793
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Integrity",
4783
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Integrity",
4794
4784
  "description": "Cryptographic integrity information for verifying this baseline has not been tampered with."
4795
4785
  },
4796
4786
  "originalChecksum": {
4797
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
4787
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
4798
4788
  "description": "SHA-256 checksum of the original baseline definition file (before execution). This is an immutable reference to the baseline as defined, used to detect tampering with baseline requirements or metadata."
4799
4789
  },
4800
4790
  "resultsChecksum": {
4801
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
4791
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
4802
4792
  "description": "SHA-256 checksum of the raw results before any amendments (statusOverrides or POAMs). Used to detect tampering with test results. Compare with currentChecksum to verify amendment integrity."
4803
4793
  },
4804
4794
  "statusMessage": {
@@ -4816,14 +4806,14 @@
4816
4806
  "groups": {
4817
4807
  "type": "array",
4818
4808
  "items": {
4819
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Requirement_Group"
4809
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Requirement_Group"
4820
4810
  },
4821
4811
  "description": "A set of descriptions for the requirement groups."
4822
4812
  },
4823
4813
  "inputs": {
4824
4814
  "type": "array",
4825
4815
  "items": {
4826
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.5.0#/$defs/Input"
4816
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.6.0#/$defs/Input"
4827
4817
  },
4828
4818
  "description": "Typed inputs used to parameterize this baseline at execution time. See the Input primitive for the full schema."
4829
4819
  },
@@ -4848,7 +4838,7 @@
4848
4838
  ],
4849
4839
  "allOf": [
4850
4840
  {
4851
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Requirement_Core"
4841
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Requirement_Core"
4852
4842
  }
4853
4843
  ],
4854
4844
  "properties": {
@@ -4856,7 +4846,7 @@
4856
4846
  "type": "array",
4857
4847
  "minItems": 1,
4858
4848
  "items": {
4859
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Requirement_Description"
4849
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Requirement_Description"
4860
4850
  },
4861
4851
  "contains": {
4862
4852
  "type": "object",
@@ -4872,37 +4862,37 @@
4872
4862
  "description": "Array of labeled descriptions. At least one description with label 'default' must be present. Convention: place default description first. Common labels: 'default', 'check', 'fix', 'rationale'."
4873
4863
  },
4874
4864
  "severity": {
4875
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Severity",
4865
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Severity",
4876
4866
  "description": "Explicit severity rating. Typically derived from impact score but provided explicitly for clarity."
4877
4867
  },
4878
4868
  "sourceLocation": {
4879
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Source_Location",
4869
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Source_Location",
4880
4870
  "description": "The explicit location of the requirement within the source code."
4881
4871
  },
4882
4872
  "results": {
4883
4873
  "type": "array",
4884
4874
  "minItems": 1,
4885
4875
  "items": {
4886
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Requirement_Result"
4876
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Requirement_Result"
4887
4877
  },
4888
4878
  "description": "The set of all tests within the requirement and their results."
4889
4879
  },
4890
4880
  "statusOverrides": {
4891
4881
  "type": "array",
4892
4882
  "items": {
4893
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/Status_Override"
4883
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/Status_Override"
4894
4884
  },
4895
4885
  "description": "Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Most recent override should be first in array. Preserves full audit trail."
4896
4886
  },
4897
4887
  "poams": {
4898
4888
  "type": "array",
4899
4889
  "items": {
4900
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.5.0#/$defs/POAM"
4890
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.6.0#/$defs/POAM"
4901
4891
  },
4902
4892
  "description": "Plan of Action and Milestones for tracking remediation, mitigation, or risk acceptance. POAMs do NOT change effectiveStatus - they track the work being done to address a failure. Separate from statusOverrides which DO change status."
4903
4893
  },
4904
4894
  "effectiveStatus": {
4905
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
4895
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
4906
4896
  "description": "The current effective compliance status of this requirement after applying the most recent non-expired override with a status field, or computed from results (worst-wins) if no status-bearing overrides exist."
4907
4897
  },
4908
4898
  "effectiveImpact": {
@@ -4912,33 +4902,33 @@
4912
4902
  "description": "The current effective impact score (0.0–1.0) after applying the most recent non-expired override with an impact field. Absent when no impact overrides apply; consumers should use the requirement's impact field in that case."
4913
4903
  },
4914
4904
  "disposition": {
4915
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.5.0#/$defs/Override_Type",
4905
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.6.0#/$defs/Override_Type",
4916
4906
  "description": "The type of the most recent non-expired override or POAM governing this requirement. Indicates why the requirement is in its current state (e.g., waiver, falsePositive, riskAdjustment) or what remediation is being tracked (poam). Absent when no overrides or POAMs apply."
4917
4907
  },
4918
4908
  "effectiveChecksum": {
4919
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
4909
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
4920
4910
  "description": "Checksum of this requirement's resolved effective posture, for per-control change detection in continuous monitoring.\n\nsha256 over the canonical JSON object with keys status, impact, disposition (in that order), holding the resolved effective status, resolved effective impact, and governing override type (null when nothing governs), with override expiry anchored to the document timestamp.\n\nFlips exactly when the operative status, impact, or disposition changes; stable under all other churn (result details, timestamps, tags).\n\nOptional; stamped by tooling (hdf convert, hdf amend apply)."
4921
4911
  },
4922
4912
  "evidence": {
4923
4913
  "type": "array",
4924
4914
  "items": {
4925
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Evidence"
4915
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Evidence"
4926
4916
  },
4927
4917
  "description": "Supporting evidence for this requirement's findings, such as screenshots, code samples, or log excerpts."
4928
4918
  },
4929
4919
  "cvss": {
4930
4920
  "type": "array",
4931
4921
  "items": {
4932
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.5.0#/$defs/Cvss"
4922
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.6.0#/$defs/Cvss"
4933
4923
  },
4934
4924
  "description": "Structured CVSS scoring data for vulnerability findings. One entry per CVE — a finding may match multiple CVEs (common in vulnerability scanners). Captures vendor-supplied Base metrics plus optional consumer-owned Threat / Environmental / Supplemental groups for risk adjustment. See cvss.schema.json."
4935
4925
  },
4936
4926
  "epss": {
4937
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.5.0#/$defs/Epss",
4927
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.6.0#/$defs/Epss",
4938
4928
  "description": "FIRST.org EPSS (Exploit Prediction Scoring System) score for this CVE finding. Used alongside CVSS for prioritization — captures the probability the vulnerability will be exploited."
4939
4929
  },
4940
4930
  "kev": {
4941
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.5.0#/$defs/Kev",
4931
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.6.0#/$defs/Kev",
4942
4932
  "description": "CISA Known Exploited Vulnerabilities (KEV) catalog status. When inKev=true, dateAdded and dueDate carry the federal patching deadline."
4943
4933
  },
4944
4934
  "cwe": {
@@ -4952,14 +4942,14 @@
4952
4942
  "affectedPackages": {
4953
4943
  "type": "array",
4954
4944
  "items": {
4955
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.5.0#/$defs/Affected_Package"
4945
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.6.0#/$defs/Affected_Package"
4956
4946
  },
4957
4947
  "description": "Packages affected by this vulnerability finding. Vulnerability-finding-scoped — see components[] on hdf-system for component-level package inventories. One entry per matched package signature (scanners often report multiple CPE variations per CVE)."
4958
4948
  }
4959
4949
  },
4950
+ "$comment": "Examples, in order: 1) Passing requirement — no overrides, no disposition; 2) Waiver — AO accepted risk, status overridden to passed; 3) False positive (compliance scan) — STIG check was wrong, requirement actually passes; 4) False positive (CVE scan) — vulnerability does not apply to this build; 5) Risk adjustment — impact lowered, pass/fail unchanged; 6) Operational requirement — cannot remediate, remains open risk; 7) POAM — remediation tracked, status unchanged.",
4960
4951
  "examples": [
4961
4952
  {
4962
- "$comment": "Passing requirement — no overrides, no disposition",
4963
4953
  "id": "SV-230222",
4964
4954
  "title": "RHEL 9 must use SSH protocol version 2",
4965
4955
  "impact": 0.7,
@@ -4984,7 +4974,6 @@
4984
4974
  "effectiveStatus": "passed"
4985
4975
  },
4986
4976
  {
4987
- "$comment": "Waiver — AO accepted risk, status overridden to passed",
4988
4977
  "id": "SV-230300",
4989
4978
  "title": "RHEL 9 must enforce password complexity",
4990
4979
  "impact": 0.5,
@@ -5028,7 +5017,6 @@
5028
5017
  }
5029
5018
  },
5030
5019
  {
5031
- "$comment": "False positive (compliance scan) — STIG check was wrong, requirement actually passes",
5032
5020
  "id": "SV-230410",
5033
5021
  "title": "RHEL 9 must have sshd PermitRootLogin disabled",
5034
5022
  "impact": 0.7,
@@ -5068,7 +5056,6 @@
5068
5056
  "disposition": "falsePositive"
5069
5057
  },
5070
5058
  {
5071
- "$comment": "False positive (CVE scan) — vulnerability does not apply to this build",
5072
5059
  "id": "CVE-2026-12345",
5073
5060
  "title": "libxml2 buffer overflow in xmlParseEntityDecl",
5074
5061
  "impact": 0.9,
@@ -5108,7 +5095,6 @@
5108
5095
  "disposition": "falsePositive"
5109
5096
  },
5110
5097
  {
5111
- "$comment": "Risk adjustment — impact lowered, pass/fail unchanged",
5112
5098
  "id": "CVE-2026-67890",
5113
5099
  "title": "OpenSSL timing side-channel in RSA decryption",
5114
5100
  "impact": 0.7,
@@ -5151,7 +5137,6 @@
5151
5137
  "disposition": "riskAdjustment"
5152
5138
  },
5153
5139
  {
5154
- "$comment": "Operational requirement — cannot remediate, remains open risk",
5155
5140
  "id": "SV-230500",
5156
5141
  "title": "RHEL 9 must disable USB mass storage",
5157
5142
  "impact": 0.5,
@@ -5191,7 +5176,6 @@
5191
5176
  "disposition": "operationalRequirement"
5192
5177
  },
5193
5178
  {
5194
- "$comment": "POAM — remediation tracked, status unchanged",
5195
5179
  "id": "SV-230350",
5196
5180
  "title": "RHEL 9 must be patched within 30 days of release",
5197
5181
  "impact": 0.7,
@@ -5247,9 +5231,9 @@
5247
5231
  }
5248
5232
  }
5249
5233
  },
5250
- "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.5.0": {
5234
+ "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.6.0": {
5251
5235
  "$schema": "https://json-schema.org/draft/2020-12/schema",
5252
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.5.0",
5236
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.6.0",
5253
5237
  "title": "HDF Statistics Primitives",
5254
5238
  "description": "Statistics types for tracking assessment run metrics.",
5255
5239
  "$defs": {
@@ -5318,9 +5302,9 @@
5318
5302
  }
5319
5303
  }
5320
5304
  },
5321
- "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.5.0": {
5305
+ "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.6.0": {
5322
5306
  "$schema": "https://json-schema.org/draft/2020-12/schema",
5323
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.5.0",
5307
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.6.0",
5324
5308
  "title": "HDF Runner Primitive",
5325
5309
  "description": "Information about the test execution environment where the security tool/scanner was executed.",
5326
5310
  "$defs": {
@@ -5364,7 +5348,7 @@
5364
5348
  "description": "The container instance identifier. Example: 'a1b2c3d4e5f6', 'security-scan-job-xyz123'. Can be a Docker container ID, Kubernetes pod name, or other container runtime identifier."
5365
5349
  },
5366
5350
  "operator": {
5367
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Identity",
5351
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Identity",
5368
5352
  "description": "The identity of the person or system responsible for executing the test. This could be a human auditor manually completing a checklist, an automated CI/CD system, or a security tool. Optional field to support both automated and manual HDF generation."
5369
5353
  }
5370
5354
  },
@@ -5413,9 +5397,9 @@
5413
5397
  }
5414
5398
  }
5415
5399
  },
5416
- "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0": {
5400
+ "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0": {
5417
5401
  "$schema": "https://json-schema.org/draft/2020-12/schema",
5418
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.5.0",
5402
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.6.0",
5419
5403
  "title": "HDF Change Event Primitives",
5420
5404
  "description": "Shared building blocks for HDF change-event wire documents. The envelope is entity-agnostic: hdf-requirement-change-event composes it today, and any future sibling event type (e.g. component change events — hdf-comparison already models componentDiffs alongside requirementDiffs) reuses it verbatim.",
5421
5405
  "$defs": {
@@ -5469,7 +5453,7 @@
5469
5453
  "priorChecksum": {
5470
5454
  "oneOf": [
5471
5455
  {
5472
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum"
5456
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum"
5473
5457
  },
5474
5458
  {
5475
5459
  "type": "null"
@@ -5478,23 +5462,22 @@
5478
5462
  "description": "The effectiveChecksum of the entity state this event supersedes, forming a per-key hash chain: a mismatch or gap against stored state is detectable, letting a consumer mark the key unverified instead of serving stale posture.\n\nNull at chain start (no prior state, e.g. a new entity or the first event after a seed).\n\nThe chain provides tamper/gap evidence given a trusted head; completeness is anchored out-of-band by periodic re-centering rescans."
5479
5463
  }
5480
5464
  },
5465
+ "$comment": "Examples, in order: 1) Steady-state envelope: mid-chain event from an InSpec producer. priorChecksum links to the previous effectiveChecksum for this key; 2) Chain-start envelope: first event for a key after seeding — priorChecksum is null (the CloudTrail null-previous-digest convention), sequence starts low.",
5481
5466
  "examples": [
5482
5467
  {
5483
- "$comment": "Steady-state envelope: mid-chain event from an InSpec producer. priorChecksum links to the previous effectiveChecksum for this key.",
5484
5468
  "eventId": "0190f6f2-1c4e-7c3a-9f2a-3b1d5e7a9c01",
5485
5469
  "source": "inspec://web01/rhel9-stig",
5486
5470
  "sequence": 412,
5487
5471
  "systemRef": "apptier.hdf-system.json",
5488
5472
  "componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
5489
5473
  "timestamp": "2026-07-22T14:03:11Z",
5490
- "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.5.0",
5474
+ "schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.6.0",
5491
5475
  "priorChecksum": {
5492
5476
  "algorithm": "sha256",
5493
5477
  "value": "704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"
5494
5478
  }
5495
5479
  },
5496
5480
  {
5497
- "$comment": "Chain-start envelope: first event for a key after seeding — priorChecksum is null (the CloudTrail null-previous-digest convention), sequence starts low.",
5498
5481
  "eventId": "0190f6f2-2a5b-7e4d-b1c8-4f2e6a8b0d12",
5499
5482
  "source": "inspec://web01/rhel9-stig",
5500
5483
  "sequence": 1,
@@ -5542,7 +5525,7 @@
5542
5525
  ],
5543
5526
  "properties": {
5544
5527
  "effectiveStatus": {
5545
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.5.0#/$defs/Result_Status",
5528
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.6.0#/$defs/Result_Status",
5546
5529
  "description": "The resolved effective compliance status at this point in the chain."
5547
5530
  },
5548
5531
  "effectiveImpact": {
@@ -5552,14 +5535,13 @@
5552
5535
  "description": "The resolved effective impact score (0.0–1.0) at this point in the chain."
5553
5536
  }
5554
5537
  },
5538
+ "$comment": "Examples, in order: 1) Prior posture of a failing SSH-cipher control before remediation; 2) Prior posture of a control passing under a waiver (the projection carries the resolved status; the governing override type travels in the requirement payload, not here).",
5555
5539
  "examples": [
5556
5540
  {
5557
- "$comment": "Prior posture of a failing SSH-cipher control before remediation.",
5558
5541
  "effectiveStatus": "failed",
5559
5542
  "effectiveImpact": 0.5
5560
5543
  },
5561
5544
  {
5562
- "$comment": "Prior posture of a control passing under a waiver (the projection carries the resolved status; the governing override type travels in the requirement payload, not here).",
5563
5545
  "effectiveStatus": "passed",
5564
5546
  "effectiveImpact": 0.5
5565
5547
  }
@@ -5592,7 +5574,7 @@
5592
5574
  "description": "URI to the seed snapshot document (relative path or absolute URL)."
5593
5575
  },
5594
5576
  "checksum": {
5595
- "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.5.0#/$defs/Checksum",
5577
+ "$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.6.0#/$defs/Checksum",
5596
5578
  "description": "Checksum of the seed snapshot, REQUIRED: the derivation pins an immutable snapshot by content, not just location."
5597
5579
  }
5598
5580
  },
@@ -5620,9 +5602,9 @@
5620
5602
  "description": "The posture-as-of time of this reconciled view (RFC 3339, trimmed UTC) — the analog of PROV's generatedAtTime."
5621
5603
  }
5622
5604
  },
5605
+ "$comment": "Examples, in order: 1) A reconciled result set: reassembled from the pinned seed scan plus 3 change events through watermark 414. The document's generator names the reconciler, never the scanner.",
5623
5606
  "examples": [
5624
5607
  {
5625
- "$comment": "A reconciled result set: reassembled from the pinned seed scan plus 3 change events through watermark 414. The document's generator names the reconciler, never the scanner.",
5626
5608
  "seed": {
5627
5609
  "uri": "apptier-seed-scan.hdf.json",
5628
5610
  "checksum": {
@@ -5641,9 +5623,9 @@
5641
5623
  }
5642
5624
  }
5643
5625
  },
5644
- "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.5.0": {
5626
+ "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.6.0": {
5645
5627
  "$schema": "https://json-schema.org/draft/2020-12/schema",
5646
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.5.0",
5628
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.6.0",
5647
5629
  "title": "HDF Parameter Primitives",
5648
5630
  "description": "Input/parameter type definitions for typed, traceable configuration values that bridge governance prose and scanner automation.",
5649
5631
  "$defs": {
@@ -5774,9 +5756,9 @@
5774
5756
  }
5775
5757
  }
5776
5758
  },
5777
- "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.5.0": {
5759
+ "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.6.0": {
5778
5760
  "$schema": "https://json-schema.org/draft/2020-12/schema",
5779
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.5.0",
5761
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.6.0",
5780
5762
  "title": "HDF EPSS Primitive",
5781
5763
  "description": "Type for representing FIRST.org's Exploit Prediction Scoring System (EPSS) data for a vulnerability. EPSS estimates the probability that a CVE will be exploited in the wild in the next 30 days. See https://www.first.org/epss/ for the underlying model and methodology.",
5782
5764
  "$defs": {
@@ -5808,21 +5790,19 @@
5808
5790
  "description": "ISO 8601 date (YYYY-MM-DD) on which FIRST.org published this EPSS score."
5809
5791
  }
5810
5792
  },
5793
+ "$comment": "Examples, in order: 1) High exploit probability and high percentile, characteristic of a widely-exploited vulnerability like Log4Shell (CVE-2021-44228) shortly after disclosure; 2) Low score but moderate percentile, the common case for CVEs that have some observed exploitation evidence but are not under active mass exploitation; 3) Very low score, typical of a CVE with no known exploitation activity or proof-of-concept availability.",
5811
5794
  "examples": [
5812
5795
  {
5813
- "$comment": "High exploit probability and high percentile, characteristic of a widely-exploited vulnerability like Log4Shell (CVE-2021-44228) shortly after disclosure.",
5814
5796
  "score": 0.97532,
5815
5797
  "percentile": 0.99987,
5816
5798
  "date": "2026-05-26"
5817
5799
  },
5818
5800
  {
5819
- "$comment": "Low score but moderate percentile, the common case for CVEs that have some observed exploitation evidence but are not under active mass exploitation.",
5820
5801
  "score": 0.04521,
5821
5802
  "percentile": 0.78432,
5822
5803
  "date": "2026-05-26"
5823
5804
  },
5824
5805
  {
5825
- "$comment": "Very low score, typical of a CVE with no known exploitation activity or proof-of-concept availability.",
5826
5806
  "score": 0.00042,
5827
5807
  "percentile": 0.10215,
5828
5808
  "date": "2026-05-26"
@@ -5833,9 +5813,9 @@
5833
5813
  }
5834
5814
  }
5835
5815
  },
5836
- "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.5.0": {
5816
+ "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.6.0": {
5837
5817
  "$schema": "https://json-schema.org/draft/2020-12/schema",
5838
- "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.5.0",
5818
+ "$id": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.6.0",
5839
5819
  "title": "HDF Kev Primitives",
5840
5820
  "description": "Types for representing CISA Known Exploited Vulnerabilities (KEV) catalog membership. The KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) flags CVEs that are confirmed actively exploited in the wild and drives federal patching urgency under CISA Binding Operational Directive 22-01.",
5841
5821
  "$defs": {
@@ -5881,23 +5861,21 @@
5881
5861
  "description": "CISA's notes describing the vulnerability, observed exploitation, or remediation guidance."
5882
5862
  }
5883
5863
  },
5864
+ "$comment": "Examples, in order: 1) High-urgency case: recently added KEV entry with a short federal patching deadline; 2) Older KEV entry whose due date has already passed — useful for reporting overdue remediation; 3) Vulnerability evaluated against the KEV catalog and confirmed not present — dateAdded/dueDate are not required when inKev is false.",
5884
5865
  "examples": [
5885
5866
  {
5886
- "$comment": "High-urgency case: recently added KEV entry with a short federal patching deadline.",
5887
5867
  "inKev": true,
5888
5868
  "dateAdded": "2026-03-15",
5889
5869
  "dueDate": "2026-04-05",
5890
5870
  "notes": "Active ransomware exploitation observed; apply vendor patch immediately."
5891
5871
  },
5892
5872
  {
5893
- "$comment": "Older KEV entry whose due date has already passed — useful for reporting overdue remediation.",
5894
5873
  "inKev": true,
5895
5874
  "dateAdded": "2023-11-07",
5896
5875
  "dueDate": "2023-11-28",
5897
5876
  "notes": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."
5898
5877
  },
5899
5878
  {
5900
- "$comment": "Vulnerability evaluated against the KEV catalog and confirmed not present — dateAdded/dueDate are not required when inKev is false.",
5901
5879
  "inKev": false
5902
5880
  }
5903
5881
  ],