@mitre/hdf-schema 3.6.0-rc.5 → 3.7.0-rc.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +10 -4
- package/dist/go/hdf.go +30 -12
- package/dist/index.js +28 -28
- package/dist/schemas/hdf-amendments.schema.json +100 -69
- package/dist/schemas/hdf-baseline.schema.json +105 -74
- package/dist/schemas/hdf-comparison.schema.json +201 -176
- package/dist/schemas/hdf-evidence-package.schema.json +105 -75
- package/dist/schemas/hdf-plan.schema.json +106 -75
- package/dist/schemas/hdf-requirement-change-event.schema.json +191 -169
- package/dist/schemas/hdf-results.schema.json +176 -150
- package/dist/schemas/hdf-system.schema.json +123 -96
- package/dist/ts/hdf.d.ts +24 -2
- package/dist/ts/hdf.ts +24 -2
- package/package.json +2 -2
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.
|
|
3
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0",
|
|
4
4
|
"title": "HDF Requirement Change Event",
|
|
5
5
|
"description": "A single continuous-monitoring wire event: one requirement's effective posture changed on one system component.\n\nThe streaming increment of a systemDrift hdf-comparison — events fold into comparisons and reassemble into hdf-results, they never mutate documents in place.\n\nOne event per wire document (NDJSON-friendly).\n\nThe envelope (identity, ordering, hash chain) is the shared Change_Event_Envelope primitive; the payload carries the producer-computable change state, a thin before projection, and the full after requirement (the evidence a responder opens the event for).\n\nDesign: ADR-0005.",
|
|
6
6
|
"type": "object",
|
|
7
7
|
"unevaluatedProperties": false,
|
|
8
8
|
"allOf": [
|
|
9
9
|
{
|
|
10
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.
|
|
10
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Change_Event_Envelope"
|
|
11
11
|
},
|
|
12
12
|
{
|
|
13
13
|
"if": {
|
|
@@ -30,7 +30,7 @@
|
|
|
30
30
|
"else": {
|
|
31
31
|
"properties": {
|
|
32
32
|
"after": {
|
|
33
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.
|
|
33
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0#/$defs/Evaluated_Requirement"
|
|
34
34
|
}
|
|
35
35
|
}
|
|
36
36
|
}
|
|
@@ -56,7 +56,7 @@
|
|
|
56
56
|
"else": {
|
|
57
57
|
"properties": {
|
|
58
58
|
"before": {
|
|
59
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.
|
|
59
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Effective_Projection"
|
|
60
60
|
}
|
|
61
61
|
}
|
|
62
62
|
}
|
|
@@ -74,20 +74,20 @@
|
|
|
74
74
|
"description": "Canonical requirement identifier — the same identity as Requirement_Diff.id and the requirement's id in hdf-results. Together with the envelope's (systemRef, componentId) this forms the durable entity key. A requirement renumbering is emitted as absent + new under the two keys, never an in-place key change; batch comparison reconciles renames via its oldId/newId matching."
|
|
75
75
|
},
|
|
76
76
|
"state": {
|
|
77
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.
|
|
77
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Event_Requirement_State",
|
|
78
78
|
"description": "The producer-computable subset of Requirement_State: new | absent | updated | fixed | regressed. fixed and regressed carry the direction SARIF's baselineState lacks; project down to SARIF's closed 4 values for external interop."
|
|
79
79
|
},
|
|
80
80
|
"changeReasons": {
|
|
81
81
|
"type": "array",
|
|
82
82
|
"items": {
|
|
83
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.
|
|
83
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Event_Change_Reason"
|
|
84
84
|
},
|
|
85
85
|
"description": "Why the state changed. An overrideExpired flip is a different triage than resultChanged: the control did not get worse, a waiver lapsed."
|
|
86
86
|
},
|
|
87
87
|
"before": {
|
|
88
88
|
"oneOf": [
|
|
89
89
|
{
|
|
90
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.
|
|
90
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Effective_Projection"
|
|
91
91
|
},
|
|
92
92
|
{
|
|
93
93
|
"type": "null"
|
|
@@ -98,7 +98,7 @@
|
|
|
98
98
|
"after": {
|
|
99
99
|
"oneOf": [
|
|
100
100
|
{
|
|
101
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.
|
|
101
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0#/$defs/Evaluated_Requirement"
|
|
102
102
|
},
|
|
103
103
|
{
|
|
104
104
|
"type": "null"
|
|
@@ -107,16 +107,16 @@
|
|
|
107
107
|
"description": "The full requirement as evaluated after the change — required and non-null for every state except absent (null there: the requirement left the assessment scope). Full content is load-bearing twice over: reassembly parity (applyChangeEvents cannot reproduce changed result content from a projection) and triage (the failing results[] ARE the 'why' a responder opens the event for)."
|
|
108
108
|
}
|
|
109
109
|
},
|
|
110
|
+
"$comment": "Examples, in order: 1) fixed — the common remediation event: a failing SSH FIPS-cipher control was fixed and rescanned. priorChecksum is the effectiveChecksum of the prior failed posture; after carries the full passing requirement including its new effectiveChecksum (the next chain link); 2) regressed via overrideExpired — the waiver that held this control at passed lapsed, so effective posture regressed to failed with NO new scan finding. A different triage than resultChanged: renew or remediate. priorChecksum is the waived posture's checksum; the expired override remains in statusOverrides as the audit record; 3) new — a requirement entered assessment scope (chain start for this key): before is null, priorChecksum is null. The full after payload is what makes the new key materializable by applyChangeEvents; 4) absent — the requirement left assessment scope (component decommissioned or benchmark rule retired): after is null by definition; the thin before preserves the last observed posture for downstream views; 5) updated via impactChanged — a riskAdjustment override lowered effective impact while the control stayed failed: status unchanged, so neither fixed nor regressed. after carries the override and the recomputed effectiveChecksum over the adjusted posture.",
|
|
110
111
|
"examples": [
|
|
111
112
|
{
|
|
112
|
-
"$comment": "fixed — the common remediation event: a failing SSH FIPS-cipher control was fixed and rescanned. priorChecksum is the effectiveChecksum of the prior failed posture; after carries the full passing requirement including its new effectiveChecksum (the next chain link).",
|
|
113
113
|
"eventId": "0190f6f2-1c4e-7c3a-9f2a-3b1d5e7a9c01",
|
|
114
114
|
"source": "inspec://web01/rhel9-stig",
|
|
115
115
|
"sequence": 412,
|
|
116
116
|
"systemRef": "apptier.hdf-system.json",
|
|
117
117
|
"componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
|
|
118
118
|
"timestamp": "2026-07-22T14:03:11Z",
|
|
119
|
-
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.
|
|
119
|
+
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0",
|
|
120
120
|
"priorChecksum": {
|
|
121
121
|
"algorithm": "sha256",
|
|
122
122
|
"value": "704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"
|
|
@@ -160,14 +160,13 @@
|
|
|
160
160
|
}
|
|
161
161
|
},
|
|
162
162
|
{
|
|
163
|
-
"$comment": "regressed via overrideExpired — the waiver that held this control at passed lapsed, so effective posture regressed to failed with NO new scan finding. A different triage than resultChanged: renew or remediate. priorChecksum is the waived posture's checksum; the expired override remains in statusOverrides as the audit record.",
|
|
164
163
|
"eventId": "0190f6f2-3b6c-7f5e-c2d9-5a3f7b9c1e23",
|
|
165
164
|
"source": "reconciler://apptier/override-sweep",
|
|
166
165
|
"sequence": 97,
|
|
167
166
|
"systemRef": "apptier.hdf-system.json",
|
|
168
167
|
"componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
|
|
169
168
|
"timestamp": "2026-07-21T00:00:05Z",
|
|
170
|
-
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.
|
|
169
|
+
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0",
|
|
171
170
|
"priorChecksum": {
|
|
172
171
|
"algorithm": "sha256",
|
|
173
172
|
"value": "d11c074ab9131807816013a71d986f1ceb2e5871a8a01dee4043391b7a6bf37b"
|
|
@@ -225,14 +224,13 @@
|
|
|
225
224
|
}
|
|
226
225
|
},
|
|
227
226
|
{
|
|
228
|
-
"$comment": "new — a requirement entered assessment scope (chain start for this key): before is null, priorChecksum is null. The full after payload is what makes the new key materializable by applyChangeEvents.",
|
|
229
227
|
"eventId": "0190f6f2-4c7d-8a6f-d3ea-6b4a8c0d2f34",
|
|
230
228
|
"source": "inspec://web01/rhel9-stig",
|
|
231
229
|
"sequence": 1,
|
|
232
230
|
"systemRef": "apptier.hdf-system.json",
|
|
233
231
|
"componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
|
|
234
232
|
"timestamp": "2026-07-22T14:03:12Z",
|
|
235
|
-
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.
|
|
233
|
+
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0",
|
|
236
234
|
"priorChecksum": null,
|
|
237
235
|
"requirementId": "RHEL-09-671010",
|
|
238
236
|
"state": "new",
|
|
@@ -267,14 +265,13 @@
|
|
|
267
265
|
}
|
|
268
266
|
},
|
|
269
267
|
{
|
|
270
|
-
"$comment": "absent — the requirement left assessment scope (component decommissioned or benchmark rule retired): after is null by definition; the thin before preserves the last observed posture for downstream views.",
|
|
271
268
|
"eventId": "0190f6f2-5d8e-9b7a-e4fb-7c5b9d1e3a45",
|
|
272
269
|
"source": "inspec://web01/rhel9-stig",
|
|
273
270
|
"sequence": 413,
|
|
274
271
|
"systemRef": "apptier.hdf-system.json",
|
|
275
272
|
"componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
|
|
276
273
|
"timestamp": "2026-07-23T08:00:00Z",
|
|
277
|
-
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.
|
|
274
|
+
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0",
|
|
278
275
|
"priorChecksum": {
|
|
279
276
|
"algorithm": "sha256",
|
|
280
277
|
"value": "704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"
|
|
@@ -288,14 +285,13 @@
|
|
|
288
285
|
"after": null
|
|
289
286
|
},
|
|
290
287
|
{
|
|
291
|
-
"$comment": "updated via impactChanged — a riskAdjustment override lowered effective impact while the control stayed failed: status unchanged, so neither fixed nor regressed. after carries the override and the recomputed effectiveChecksum over the adjusted posture.",
|
|
292
288
|
"eventId": "0190f6f2-6e9f-0c8b-f5ac-8d6c0e2f4b56",
|
|
293
289
|
"source": "reconciler://apptier/amend-apply",
|
|
294
290
|
"sequence": 414,
|
|
295
291
|
"systemRef": "apptier.hdf-system.json",
|
|
296
292
|
"componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
|
|
297
293
|
"timestamp": "2026-07-24T10:15:00Z",
|
|
298
|
-
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.
|
|
294
|
+
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0",
|
|
299
295
|
"priorChecksum": {
|
|
300
296
|
"algorithm": "sha256",
|
|
301
297
|
"value": "704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"
|
|
@@ -358,9 +354,9 @@
|
|
|
358
354
|
}
|
|
359
355
|
],
|
|
360
356
|
"$defs": {
|
|
361
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.
|
|
357
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0": {
|
|
362
358
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
363
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.
|
|
359
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0",
|
|
364
360
|
"title": "HDF Change Event Primitives",
|
|
365
361
|
"description": "Shared building blocks for HDF change-event wire documents. The envelope is entity-agnostic: hdf-requirement-change-event composes it today, and any future sibling event type (e.g. component change events — hdf-comparison already models componentDiffs alongside requirementDiffs) reuses it verbatim.",
|
|
366
362
|
"$defs": {
|
|
@@ -414,7 +410,7 @@
|
|
|
414
410
|
"priorChecksum": {
|
|
415
411
|
"oneOf": [
|
|
416
412
|
{
|
|
417
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
413
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum"
|
|
418
414
|
},
|
|
419
415
|
{
|
|
420
416
|
"type": "null"
|
|
@@ -423,23 +419,22 @@
|
|
|
423
419
|
"description": "The effectiveChecksum of the entity state this event supersedes, forming a per-key hash chain: a mismatch or gap against stored state is detectable, letting a consumer mark the key unverified instead of serving stale posture.\n\nNull at chain start (no prior state, e.g. a new entity or the first event after a seed).\n\nThe chain provides tamper/gap evidence given a trusted head; completeness is anchored out-of-band by periodic re-centering rescans."
|
|
424
420
|
}
|
|
425
421
|
},
|
|
422
|
+
"$comment": "Examples, in order: 1) Steady-state envelope: mid-chain event from an InSpec producer. priorChecksum links to the previous effectiveChecksum for this key; 2) Chain-start envelope: first event for a key after seeding — priorChecksum is null (the CloudTrail null-previous-digest convention), sequence starts low.",
|
|
426
423
|
"examples": [
|
|
427
424
|
{
|
|
428
|
-
"$comment": "Steady-state envelope: mid-chain event from an InSpec producer. priorChecksum links to the previous effectiveChecksum for this key.",
|
|
429
425
|
"eventId": "0190f6f2-1c4e-7c3a-9f2a-3b1d5e7a9c01",
|
|
430
426
|
"source": "inspec://web01/rhel9-stig",
|
|
431
427
|
"sequence": 412,
|
|
432
428
|
"systemRef": "apptier.hdf-system.json",
|
|
433
429
|
"componentId": "6e0f2a3b-9c01-4d5e-8f7a-1b2c3d4e5f60",
|
|
434
430
|
"timestamp": "2026-07-22T14:03:11Z",
|
|
435
|
-
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.
|
|
431
|
+
"schemaRef": "https://mitre.github.io/hdf-libs/schemas/hdf-requirement-change-event/v3.7.0",
|
|
436
432
|
"priorChecksum": {
|
|
437
433
|
"algorithm": "sha256",
|
|
438
434
|
"value": "704f62b2d0803438ad6b7b9bab45e2c4f350b7344135a2a7f8ef986d98669021"
|
|
439
435
|
}
|
|
440
436
|
},
|
|
441
437
|
{
|
|
442
|
-
"$comment": "Chain-start envelope: first event for a key after seeding — priorChecksum is null (the CloudTrail null-previous-digest convention), sequence starts low.",
|
|
443
438
|
"eventId": "0190f6f2-2a5b-7e4d-b1c8-4f2e6a8b0d12",
|
|
444
439
|
"source": "inspec://web01/rhel9-stig",
|
|
445
440
|
"sequence": 1,
|
|
@@ -487,7 +482,7 @@
|
|
|
487
482
|
],
|
|
488
483
|
"properties": {
|
|
489
484
|
"effectiveStatus": {
|
|
490
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.
|
|
485
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status",
|
|
491
486
|
"description": "The resolved effective compliance status at this point in the chain."
|
|
492
487
|
},
|
|
493
488
|
"effectiveImpact": {
|
|
@@ -497,14 +492,13 @@
|
|
|
497
492
|
"description": "The resolved effective impact score (0.0–1.0) at this point in the chain."
|
|
498
493
|
}
|
|
499
494
|
},
|
|
495
|
+
"$comment": "Examples, in order: 1) Prior posture of a failing SSH-cipher control before remediation; 2) Prior posture of a control passing under a waiver (the projection carries the resolved status; the governing override type travels in the requirement payload, not here).",
|
|
500
496
|
"examples": [
|
|
501
497
|
{
|
|
502
|
-
"$comment": "Prior posture of a failing SSH-cipher control before remediation.",
|
|
503
498
|
"effectiveStatus": "failed",
|
|
504
499
|
"effectiveImpact": 0.5
|
|
505
500
|
},
|
|
506
501
|
{
|
|
507
|
-
"$comment": "Prior posture of a control passing under a waiver (the projection carries the resolved status; the governing override type travels in the requirement payload, not here).",
|
|
508
502
|
"effectiveStatus": "passed",
|
|
509
503
|
"effectiveImpact": 0.5
|
|
510
504
|
}
|
|
@@ -537,7 +531,7 @@
|
|
|
537
531
|
"description": "URI to the seed snapshot document (relative path or absolute URL)."
|
|
538
532
|
},
|
|
539
533
|
"checksum": {
|
|
540
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
534
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
|
|
541
535
|
"description": "Checksum of the seed snapshot, REQUIRED: the derivation pins an immutable snapshot by content, not just location."
|
|
542
536
|
}
|
|
543
537
|
},
|
|
@@ -565,9 +559,9 @@
|
|
|
565
559
|
"description": "The posture-as-of time of this reconciled view (RFC 3339, trimmed UTC) — the analog of PROV's generatedAtTime."
|
|
566
560
|
}
|
|
567
561
|
},
|
|
562
|
+
"$comment": "Examples, in order: 1) A reconciled result set: reassembled from the pinned seed scan plus 3 change events through watermark 414. The document's generator names the reconciler, never the scanner.",
|
|
568
563
|
"examples": [
|
|
569
564
|
{
|
|
570
|
-
"$comment": "A reconciled result set: reassembled from the pinned seed scan plus 3 change events through watermark 414. The document's generator names the reconciler, never the scanner.",
|
|
571
565
|
"seed": {
|
|
572
566
|
"uri": "apptier-seed-scan.hdf.json",
|
|
573
567
|
"checksum": {
|
|
@@ -586,9 +580,9 @@
|
|
|
586
580
|
}
|
|
587
581
|
}
|
|
588
582
|
},
|
|
589
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
583
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0": {
|
|
590
584
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
591
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
585
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0",
|
|
592
586
|
"title": "HDF Common Primitives",
|
|
593
587
|
"description": "Shared building blocks used by hdf-results and hdf-baseline schemas.",
|
|
594
588
|
"$defs": {
|
|
@@ -668,22 +662,20 @@
|
|
|
668
662
|
}
|
|
669
663
|
},
|
|
670
664
|
"unevaluatedProperties": false,
|
|
665
|
+
"$comment": "Examples, in order: 1) By-identity: cite a CVE by its id in the 'cve' system without a URL — equivalently urn:cve:CVE-2021-44228; 2) By-identity AND by-locator together (anyOf, not oneOf) — an ATT&CK technique cited by id with its canonical URL; 3) By-locator to a retrievable STIX bundle, with integrity hash, media type, and attribution; 4) Enrichment envelope: a STIX threat-intel object embedded losslessly in `document` and classified via `kind`, cited by id and pointed at by href — the pointer and the embedded copy compose. The payload rides verbatim; HDF does not normalize STIX fields.",
|
|
671
666
|
"examples": [
|
|
672
667
|
{
|
|
673
|
-
"$comment": "By-identity: cite a CVE by its id in the 'cve' system without a URL — equivalently urn:cve:CVE-2021-44228.",
|
|
674
668
|
"sourceName": "cve",
|
|
675
669
|
"externalId": "CVE-2021-44228",
|
|
676
670
|
"rel": "definition"
|
|
677
671
|
},
|
|
678
672
|
{
|
|
679
|
-
"$comment": "By-identity AND by-locator together (anyOf, not oneOf) — an ATT&CK technique cited by id with its canonical URL.",
|
|
680
673
|
"sourceName": "mitre-att&ck",
|
|
681
674
|
"externalId": "T1059",
|
|
682
675
|
"href": "https://attack.mitre.org/techniques/T1059/",
|
|
683
676
|
"rel": "canonical"
|
|
684
677
|
},
|
|
685
678
|
{
|
|
686
|
-
"$comment": "By-locator to a retrievable STIX bundle, with integrity hash, media type, and attribution.",
|
|
687
679
|
"sourceName": "stix",
|
|
688
680
|
"href": "https://cti.example.org/bundles/log4shell.json",
|
|
689
681
|
"rel": "investigate",
|
|
@@ -699,7 +691,6 @@
|
|
|
699
691
|
"addedAt": "2026-07-26T00:00:00Z"
|
|
700
692
|
},
|
|
701
693
|
{
|
|
702
|
-
"$comment": "Enrichment envelope: a STIX threat-intel object embedded losslessly in `document` and classified via `kind`, cited by id and pointed at by href — the pointer and the embedded copy compose. The payload rides verbatim; HDF does not normalize STIX fields.",
|
|
703
694
|
"sourceName": "stix",
|
|
704
695
|
"externalId": "vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001",
|
|
705
696
|
"href": "https://cti.example.org/bundles/log4shell.json#vulnerability--f7c1b8e0-1234-4a2b-9c3d-000000000001",
|
|
@@ -1031,6 +1022,24 @@
|
|
|
1031
1022
|
"type",
|
|
1032
1023
|
"data"
|
|
1033
1024
|
],
|
|
1025
|
+
"if": {
|
|
1026
|
+
"properties": {
|
|
1027
|
+
"encoding": {
|
|
1028
|
+
"const": "base64"
|
|
1029
|
+
}
|
|
1030
|
+
},
|
|
1031
|
+
"required": [
|
|
1032
|
+
"encoding"
|
|
1033
|
+
]
|
|
1034
|
+
},
|
|
1035
|
+
"then": {
|
|
1036
|
+
"properties": {
|
|
1037
|
+
"data": {
|
|
1038
|
+
"pattern": "^[0-9A-Za-z+/]+={0,2}$",
|
|
1039
|
+
"contentEncoding": "base64"
|
|
1040
|
+
}
|
|
1041
|
+
}
|
|
1042
|
+
},
|
|
1034
1043
|
"properties": {
|
|
1035
1044
|
"type": {
|
|
1036
1045
|
"type": "string",
|
|
@@ -1047,7 +1056,8 @@
|
|
|
1047
1056
|
},
|
|
1048
1057
|
"data": {
|
|
1049
1058
|
"type": "string",
|
|
1050
|
-
"
|
|
1059
|
+
"minLength": 1,
|
|
1060
|
+
"description": "The evidence content. For screenshots/files: base64-encoded data or URL. For code/logs: the raw text. For URLs: the URL string. Must not be empty. When encoding is 'base64', data must be bare base64 matching ^[0-9A-Za-z+/]+={0,2}$ (OSCAL's Base64Datatype): no data: URI prefix, URL, or line breaks."
|
|
1051
1061
|
},
|
|
1052
1062
|
"description": {
|
|
1053
1063
|
"type": "string",
|
|
@@ -1059,7 +1069,7 @@
|
|
|
1059
1069
|
},
|
|
1060
1070
|
"encoding": {
|
|
1061
1071
|
"type": "string",
|
|
1062
|
-
"description": "Encoding used for the data. Example: 'base64', 'utf-8'."
|
|
1072
|
+
"description": "Encoding used for the data. Example: 'base64', 'utf-8'. The value 'base64' (exactly, lowercase) requires data to be bare base64."
|
|
1063
1073
|
},
|
|
1064
1074
|
"size": {
|
|
1065
1075
|
"type": "number",
|
|
@@ -1123,6 +1133,7 @@
|
|
|
1123
1133
|
}
|
|
1124
1134
|
}
|
|
1125
1135
|
],
|
|
1136
|
+
"$comment": "Examples, in order: 1) base64-encoded PNG screenshot with full capture provenance; 2) raw configuration text; 3) log excerpt; 4) URL to an external ticket; 5) base64-encoded file captured by an automated system.",
|
|
1126
1137
|
"description": "Supporting evidence for a finding or override, such as screenshots, code samples, log excerpts, or URLs.",
|
|
1127
1138
|
"title": "Evidence"
|
|
1128
1139
|
},
|
|
@@ -1200,6 +1211,13 @@
|
|
|
1200
1211
|
"status"
|
|
1201
1212
|
],
|
|
1202
1213
|
"properties": {
|
|
1214
|
+
"title": {
|
|
1215
|
+
"type": "string",
|
|
1216
|
+
"minLength": 1,
|
|
1217
|
+
"pattern": "^[^ \\t\\n\\r]([^\\n\\r]*[^ \\t\\n\\r])?$",
|
|
1218
|
+
"$comment": "The pattern is OSCAL's StringDatatype (\\S(.*\\S)?) as its XSD defines \\S and '.', spelled with explicit classes so ECMA-262 and Go regexp engines agree: \\S and '.' differ between them on CR and non-ASCII whitespace.",
|
|
1219
|
+
"description": "Short single-line label for this milestone, suitable where a consumer needs a title (for example an OSCAL POA&M remediation or task). No line breaks, and no leading or trailing whitespace. The description remains the full text of the milestone; the title does not replace it."
|
|
1220
|
+
},
|
|
1203
1221
|
"description": {
|
|
1204
1222
|
"type": "string",
|
|
1205
1223
|
"description": "Description of this milestone or task."
|
|
@@ -1229,6 +1247,25 @@
|
|
|
1229
1247
|
"description": "Identity of who completed this milestone."
|
|
1230
1248
|
}
|
|
1231
1249
|
},
|
|
1250
|
+
"examples": [
|
|
1251
|
+
{
|
|
1252
|
+
"title": "Deploy OpenSSH 9.8p1",
|
|
1253
|
+
"description": "Upgrade OpenSSH to 9.8p1 on every RHEL 9 host in the web tier to remediate CVE-2024-6387, then restart sshd during the Saturday maintenance window.",
|
|
1254
|
+
"estimatedCompletion": "2026-10-31T00:00:00Z",
|
|
1255
|
+
"status": "inProgress"
|
|
1256
|
+
},
|
|
1257
|
+
{
|
|
1258
|
+
"description": "Isolate the affected host on a restricted VLAN until the vendor patch is available.",
|
|
1259
|
+
"estimatedCompletion": "2026-09-05T00:00:00Z",
|
|
1260
|
+
"status": "completed",
|
|
1261
|
+
"completedAt": "2026-09-04T14:30:00Z",
|
|
1262
|
+
"completedBy": {
|
|
1263
|
+
"identifier": "network-admin@example.com",
|
|
1264
|
+
"type": "email"
|
|
1265
|
+
}
|
|
1266
|
+
}
|
|
1267
|
+
],
|
|
1268
|
+
"$comment": "Examples, in order: 1) titled milestone in progress — the title is the short label, the description the full remediation text; 2) untitled completed milestone with completion provenance — title is optional, and a consumer needing one derives it.",
|
|
1232
1269
|
"description": "A milestone or task within a POA&M remediation plan.",
|
|
1233
1270
|
"title": "Milestone"
|
|
1234
1271
|
},
|
|
@@ -1518,9 +1555,9 @@
|
|
|
1518
1555
|
"description": "Whether the requirement is mandatory within its baseline.\n\nDistinct from severity (risk weight) and status (lifecycle state).\n\nMaps cleanly onto: FedRAMP rev5 OSCAL 'CORE' prop, FedRAMP 20x inline 'Optional:' markers, CMMC sublevel rows, and CIS Implementation Group memberships (IG1/IG2/IG3 may carry richer semantics; layer those onto props[]/tags{}).\n\nOptional: when omitted, consumers should treat the requirement as 'required' by convention."
|
|
1519
1556
|
}
|
|
1520
1557
|
},
|
|
1558
|
+
"$comment": "Examples, in order: 1) v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape for backward compatibility; 2) v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline; 3) v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement; 4) v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
|
|
1521
1559
|
"examples": [
|
|
1522
1560
|
{
|
|
1523
|
-
"$comment": "v3.1.x-style requirement: classification fields omitted. Consumers must continue to handle this shape under v3.5.0 (backward compatibility).",
|
|
1524
1561
|
"id": "SV-238196",
|
|
1525
1562
|
"title": "The Ubuntu operating system must enforce password complexity",
|
|
1526
1563
|
"impact": 0.5,
|
|
@@ -1550,7 +1587,6 @@
|
|
|
1550
1587
|
]
|
|
1551
1588
|
},
|
|
1552
1589
|
{
|
|
1553
|
-
"$comment": "v3.2 example populating all three classification fields. controlType=technical because AC-3 is enforced via configuration, not policy text. verificationMethod=automated because a check exists. applicability=required because this is a CORE control in the source baseline.",
|
|
1554
1590
|
"id": "AC-3",
|
|
1555
1591
|
"title": "Access Enforcement",
|
|
1556
1592
|
"impact": 0.7,
|
|
@@ -1572,7 +1608,6 @@
|
|
|
1572
1608
|
"applicability": "required"
|
|
1573
1609
|
},
|
|
1574
1610
|
{
|
|
1575
|
-
"$comment": "v3.2 example for a manual-by-design requirement. FedRAMP 20x KSIs are statement-form: code is omitted (not null) and verificationMethod=manual-by-design distinguishes this from 'automation could exist but doesn't yet'. controlType=policy because this is an authored governance statement.",
|
|
1576
1611
|
"id": "KSI-CNA-01",
|
|
1577
1612
|
"title": "Cyber Security Plan documents the system",
|
|
1578
1613
|
"impact": 0.5,
|
|
@@ -1592,7 +1627,6 @@
|
|
|
1592
1627
|
"applicability": "required"
|
|
1593
1628
|
},
|
|
1594
1629
|
{
|
|
1595
|
-
"$comment": "v3.2 example for a STIG rule lacking a <fix>. Differs from manual-by-design: automation should exist, just not yet. applicability=advisory used here because the source format flagged it as recommended-but-not-mandatory; CIS-style IG memberships and FedRAMP 'Optional:' markers map onto applicability=optional or advisory similarly.",
|
|
1596
1630
|
"id": "SV-999999",
|
|
1597
1631
|
"title": "Example STIG rule pending automation",
|
|
1598
1632
|
"impact": 0.3,
|
|
@@ -1657,9 +1691,9 @@
|
|
|
1657
1691
|
}
|
|
1658
1692
|
}
|
|
1659
1693
|
},
|
|
1660
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.
|
|
1694
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0": {
|
|
1661
1695
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
1662
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.
|
|
1696
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0",
|
|
1663
1697
|
"title": "HDF Result Primitives",
|
|
1664
1698
|
"description": "Types for representing assessment results and statuses.",
|
|
1665
1699
|
"$defs": {
|
|
@@ -1790,9 +1824,9 @@
|
|
|
1790
1824
|
}
|
|
1791
1825
|
}
|
|
1792
1826
|
},
|
|
1793
|
-
"https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.
|
|
1827
|
+
"https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0": {
|
|
1794
1828
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
1795
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.
|
|
1829
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/hdf-results/v3.7.0",
|
|
1796
1830
|
"type": "object",
|
|
1797
1831
|
"unevaluatedProperties": false,
|
|
1798
1832
|
"required": [
|
|
@@ -1802,7 +1836,7 @@
|
|
|
1802
1836
|
"externalReferences": {
|
|
1803
1837
|
"type": "array",
|
|
1804
1838
|
"items": {
|
|
1805
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
1839
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"
|
|
1806
1840
|
},
|
|
1807
1841
|
"description": "Optional references to external artifacts (CTI/STIX, BOMs, advisories, runbooks, or any URI-addressable artifact) relevant to this assessment as a whole. Inert context; see External_Reference."
|
|
1808
1842
|
},
|
|
@@ -1819,7 +1853,7 @@
|
|
|
1819
1853
|
"components": {
|
|
1820
1854
|
"type": "array",
|
|
1821
1855
|
"items": {
|
|
1822
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.
|
|
1856
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0#/$defs/Component"
|
|
1823
1857
|
},
|
|
1824
1858
|
"description": "The components that were assessed. Each component describes a system element (host, container, cloud resource, application, etc.) with optional identity, SBOM, and external references."
|
|
1825
1859
|
},
|
|
@@ -1831,27 +1865,38 @@
|
|
|
1831
1865
|
"description": "Information on the baselines that were evaluated, including findings."
|
|
1832
1866
|
},
|
|
1833
1867
|
"statistics": {
|
|
1834
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.
|
|
1868
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.7.0#/$defs/Statistics",
|
|
1835
1869
|
"description": "Statistics for the assessment run, including duration and result counts."
|
|
1836
1870
|
},
|
|
1837
1871
|
"generator": {
|
|
1838
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.
|
|
1872
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Generator",
|
|
1839
1873
|
"description": "Information about the tool that generated this file."
|
|
1840
1874
|
},
|
|
1841
1875
|
"tool": {
|
|
1842
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.
|
|
1876
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Tool",
|
|
1843
1877
|
"description": "The security tool that produced the assessment data in this file."
|
|
1844
1878
|
},
|
|
1845
1879
|
"integrity": {
|
|
1846
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.
|
|
1880
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity",
|
|
1847
1881
|
"description": "Cryptographic integrity information for verifying this file."
|
|
1848
1882
|
},
|
|
1883
|
+
"preAmendmentChecksum": {
|
|
1884
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
|
|
1885
|
+
"description": "Hash of this results document as it stood immediately before the most recent amendment application. Written by `hdf amend apply` when it applies at least one override; an apply that matches nothing leaves the document untouched. The hash covers the results file's RAW BYTES as read, not a canonical form, so reproducing it requires the byte-identical original — reformatting or re-serializing the source changes the value. Only the most recent pre-application state is recorded: applying amendments to an already-amended document REPLACES this value, so it is a single link back one step, not a growing chain. Distinct from the `previousChecksum` inside an override, which chains amendments to each other and is computed over a canonical JSON form.",
|
|
1886
|
+
"$comment": "Example 1: the real SHA-256 of hdf-converters/converters/nessus-to-hdf/fixtures/expected/sample.nessus.hdf.json, reproducible with `shasum -a 256` on that file — chosen over a synthetic digest so a reader can verify the hash basis is the raw file bytes.",
|
|
1887
|
+
"examples": [
|
|
1888
|
+
{
|
|
1889
|
+
"algorithm": "sha256",
|
|
1890
|
+
"value": "9599ce7889e99b70ef5d0f3efa4215e35059c10a7e89b9314cbf4ded8fdbad38"
|
|
1891
|
+
}
|
|
1892
|
+
]
|
|
1893
|
+
},
|
|
1849
1894
|
"runner": {
|
|
1850
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.
|
|
1895
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.7.0#/$defs/Runner",
|
|
1851
1896
|
"description": "Information about the test execution environment where the security tool was run. Distinct from targets (what is being tested)."
|
|
1852
1897
|
},
|
|
1853
1898
|
"remediation": {
|
|
1854
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
1899
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Remediation",
|
|
1855
1900
|
"description": "Optional reference to automated remediation resources (Ansible playbooks, Terraform scripts, etc.) for fixing failing requirements found in this assessment."
|
|
1856
1901
|
},
|
|
1857
1902
|
"systemRef": {
|
|
@@ -1865,7 +1910,7 @@
|
|
|
1865
1910
|
"description": "Reference to an hdf-plan document describing the assessment plan that produced these results. May be a relative path, absolute URI, or fragment identifier."
|
|
1866
1911
|
},
|
|
1867
1912
|
"derivation": {
|
|
1868
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.
|
|
1913
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/events/v3.7.0#/$defs/Derivation",
|
|
1869
1914
|
"description": "Present ONLY on reconciled result sets: lineage recording the seed snapshot and event watermark this document was reassembled from (ADR-0005). Documents produced directly by a scan omit this field. When present, generator names the reconciling tool."
|
|
1870
1915
|
},
|
|
1871
1916
|
"extensions": {
|
|
@@ -1963,14 +2008,14 @@
|
|
|
1963
2008
|
],
|
|
1964
2009
|
"allOf": [
|
|
1965
2010
|
{
|
|
1966
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2011
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Baseline_Metadata"
|
|
1967
2012
|
}
|
|
1968
2013
|
],
|
|
1969
2014
|
"properties": {
|
|
1970
2015
|
"depends": {
|
|
1971
2016
|
"type": "array",
|
|
1972
2017
|
"items": {
|
|
1973
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2018
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Dependency"
|
|
1974
2019
|
},
|
|
1975
2020
|
"description": "The set of dependencies this baseline depends on."
|
|
1976
2021
|
},
|
|
@@ -1983,15 +2028,15 @@
|
|
|
1983
2028
|
"description": "The description - should be more detailed than the summary."
|
|
1984
2029
|
},
|
|
1985
2030
|
"integrity": {
|
|
1986
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.
|
|
2031
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Integrity",
|
|
1987
2032
|
"description": "Cryptographic integrity information for verifying this baseline has not been tampered with."
|
|
1988
2033
|
},
|
|
1989
2034
|
"originalChecksum": {
|
|
1990
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2035
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
|
|
1991
2036
|
"description": "SHA-256 checksum of the original baseline definition file (before execution). This is an immutable reference to the baseline as defined, used to detect tampering with baseline requirements or metadata."
|
|
1992
2037
|
},
|
|
1993
2038
|
"resultsChecksum": {
|
|
1994
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2039
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
|
|
1995
2040
|
"description": "SHA-256 checksum of the raw results before any amendments (statusOverrides or POAMs). Used to detect tampering with test results. Compare with currentChecksum to verify amendment integrity."
|
|
1996
2041
|
},
|
|
1997
2042
|
"statusMessage": {
|
|
@@ -2009,14 +2054,14 @@
|
|
|
2009
2054
|
"groups": {
|
|
2010
2055
|
"type": "array",
|
|
2011
2056
|
"items": {
|
|
2012
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2057
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Requirement_Group"
|
|
2013
2058
|
},
|
|
2014
2059
|
"description": "A set of descriptions for the requirement groups."
|
|
2015
2060
|
},
|
|
2016
2061
|
"inputs": {
|
|
2017
2062
|
"type": "array",
|
|
2018
2063
|
"items": {
|
|
2019
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.
|
|
2064
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.7.0#/$defs/Input"
|
|
2020
2065
|
},
|
|
2021
2066
|
"description": "Typed inputs used to parameterize this baseline at execution time. See the Input primitive for the full schema."
|
|
2022
2067
|
},
|
|
@@ -2041,7 +2086,7 @@
|
|
|
2041
2086
|
],
|
|
2042
2087
|
"allOf": [
|
|
2043
2088
|
{
|
|
2044
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2089
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Requirement_Core"
|
|
2045
2090
|
}
|
|
2046
2091
|
],
|
|
2047
2092
|
"properties": {
|
|
@@ -2049,7 +2094,7 @@
|
|
|
2049
2094
|
"type": "array",
|
|
2050
2095
|
"minItems": 1,
|
|
2051
2096
|
"items": {
|
|
2052
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.
|
|
2097
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Requirement_Description"
|
|
2053
2098
|
},
|
|
2054
2099
|
"contains": {
|
|
2055
2100
|
"type": "object",
|
|
@@ -2065,37 +2110,37 @@
|
|
|
2065
2110
|
"description": "Array of labeled descriptions. At least one description with label 'default' must be present. Convention: place default description first. Common labels: 'default', 'check', 'fix', 'rationale'."
|
|
2066
2111
|
},
|
|
2067
2112
|
"severity": {
|
|
2068
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2113
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Severity",
|
|
2069
2114
|
"description": "Explicit severity rating. Typically derived from impact score but provided explicitly for clarity."
|
|
2070
2115
|
},
|
|
2071
2116
|
"sourceLocation": {
|
|
2072
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2117
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Source_Location",
|
|
2073
2118
|
"description": "The explicit location of the requirement within the source code."
|
|
2074
2119
|
},
|
|
2075
2120
|
"results": {
|
|
2076
2121
|
"type": "array",
|
|
2077
2122
|
"minItems": 1,
|
|
2078
2123
|
"items": {
|
|
2079
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.
|
|
2124
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Requirement_Result"
|
|
2080
2125
|
},
|
|
2081
2126
|
"description": "The set of all tests within the requirement and their results."
|
|
2082
2127
|
},
|
|
2083
2128
|
"statusOverrides": {
|
|
2084
2129
|
"type": "array",
|
|
2085
2130
|
"items": {
|
|
2086
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.
|
|
2131
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/Status_Override"
|
|
2087
2132
|
},
|
|
2088
2133
|
"description": "Chronological history of all overrides applied to this requirement. Overrides are intentional changes to the compliance status and/or impact score (waivers, attestations, false positives, risk adjustments). Most recent override should be first in array. Preserves full audit trail."
|
|
2089
2134
|
},
|
|
2090
2135
|
"poams": {
|
|
2091
2136
|
"type": "array",
|
|
2092
2137
|
"items": {
|
|
2093
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.
|
|
2138
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0#/$defs/POAM"
|
|
2094
2139
|
},
|
|
2095
2140
|
"description": "Plan of Action and Milestones for tracking remediation, mitigation, or risk acceptance. POAMs do NOT change effectiveStatus - they track the work being done to address a failure. Separate from statusOverrides which DO change status."
|
|
2096
2141
|
},
|
|
2097
2142
|
"effectiveStatus": {
|
|
2098
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.
|
|
2143
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status",
|
|
2099
2144
|
"description": "The current effective compliance status of this requirement after applying the most recent non-expired override with a status field, or computed from results (worst-wins) if no status-bearing overrides exist."
|
|
2100
2145
|
},
|
|
2101
2146
|
"effectiveImpact": {
|
|
@@ -2105,33 +2150,33 @@
|
|
|
2105
2150
|
"description": "The current effective impact score (0.0–1.0) after applying the most recent non-expired override with an impact field. Absent when no impact overrides apply; consumers should use the requirement's impact field in that case."
|
|
2106
2151
|
},
|
|
2107
2152
|
"disposition": {
|
|
2108
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.
|
|
2153
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Override_Type",
|
|
2109
2154
|
"description": "The type of the most recent non-expired override or POAM governing this requirement. Indicates why the requirement is in its current state (e.g., waiver, falsePositive, riskAdjustment) or what remediation is being tracked (poam). Absent when no overrides or POAMs apply."
|
|
2110
2155
|
},
|
|
2111
2156
|
"effectiveChecksum": {
|
|
2112
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2157
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
|
|
2113
2158
|
"description": "Checksum of this requirement's resolved effective posture, for per-control change detection in continuous monitoring.\n\nsha256 over the canonical JSON object with keys status, impact, disposition (in that order), holding the resolved effective status, resolved effective impact, and governing override type (null when nothing governs), with override expiry anchored to the document timestamp.\n\nFlips exactly when the operative status, impact, or disposition changes; stable under all other churn (result details, timestamps, tags).\n\nOptional; stamped by tooling (hdf convert, hdf amend apply)."
|
|
2114
2159
|
},
|
|
2115
2160
|
"evidence": {
|
|
2116
2161
|
"type": "array",
|
|
2117
2162
|
"items": {
|
|
2118
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2163
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"
|
|
2119
2164
|
},
|
|
2120
2165
|
"description": "Supporting evidence for this requirement's findings, such as screenshots, code samples, or log excerpts."
|
|
2121
2166
|
},
|
|
2122
2167
|
"cvss": {
|
|
2123
2168
|
"type": "array",
|
|
2124
2169
|
"items": {
|
|
2125
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.
|
|
2170
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0#/$defs/Cvss"
|
|
2126
2171
|
},
|
|
2127
2172
|
"description": "Structured CVSS scoring data for vulnerability findings. One entry per CVE — a finding may match multiple CVEs (common in vulnerability scanners). Captures vendor-supplied Base metrics plus optional consumer-owned Threat / Environmental / Supplemental groups for risk adjustment. See cvss.schema.json."
|
|
2128
2173
|
},
|
|
2129
2174
|
"epss": {
|
|
2130
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.
|
|
2175
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.7.0#/$defs/Epss",
|
|
2131
2176
|
"description": "FIRST.org EPSS (Exploit Prediction Scoring System) score for this CVE finding. Used alongside CVSS for prioritization — captures the probability the vulnerability will be exploited."
|
|
2132
2177
|
},
|
|
2133
2178
|
"kev": {
|
|
2134
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.
|
|
2179
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.7.0#/$defs/Kev",
|
|
2135
2180
|
"description": "CISA Known Exploited Vulnerabilities (KEV) catalog status. When inKev=true, dateAdded and dueDate carry the federal patching deadline."
|
|
2136
2181
|
},
|
|
2137
2182
|
"cwe": {
|
|
@@ -2145,14 +2190,14 @@
|
|
|
2145
2190
|
"affectedPackages": {
|
|
2146
2191
|
"type": "array",
|
|
2147
2192
|
"items": {
|
|
2148
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.
|
|
2193
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0#/$defs/Affected_Package"
|
|
2149
2194
|
},
|
|
2150
2195
|
"description": "Packages affected by this vulnerability finding. Vulnerability-finding-scoped — see components[] on hdf-system for component-level package inventories. One entry per matched package signature (scanners often report multiple CPE variations per CVE)."
|
|
2151
2196
|
}
|
|
2152
2197
|
},
|
|
2198
|
+
"$comment": "Examples, in order: 1) Passing requirement — no overrides, no disposition; 2) Waiver — AO accepted risk, status overridden to passed; 3) False positive (compliance scan) — STIG check was wrong, requirement actually passes; 4) False positive (CVE scan) — vulnerability does not apply to this build; 5) Risk adjustment — impact lowered, pass/fail unchanged; 6) Operational requirement — cannot remediate, remains open risk; 7) POAM — remediation tracked, status unchanged.",
|
|
2153
2199
|
"examples": [
|
|
2154
2200
|
{
|
|
2155
|
-
"$comment": "Passing requirement — no overrides, no disposition",
|
|
2156
2201
|
"id": "SV-230222",
|
|
2157
2202
|
"title": "RHEL 9 must use SSH protocol version 2",
|
|
2158
2203
|
"impact": 0.7,
|
|
@@ -2177,7 +2222,6 @@
|
|
|
2177
2222
|
"effectiveStatus": "passed"
|
|
2178
2223
|
},
|
|
2179
2224
|
{
|
|
2180
|
-
"$comment": "Waiver — AO accepted risk, status overridden to passed",
|
|
2181
2225
|
"id": "SV-230300",
|
|
2182
2226
|
"title": "RHEL 9 must enforce password complexity",
|
|
2183
2227
|
"impact": 0.5,
|
|
@@ -2221,7 +2265,6 @@
|
|
|
2221
2265
|
}
|
|
2222
2266
|
},
|
|
2223
2267
|
{
|
|
2224
|
-
"$comment": "False positive (compliance scan) — STIG check was wrong, requirement actually passes",
|
|
2225
2268
|
"id": "SV-230410",
|
|
2226
2269
|
"title": "RHEL 9 must have sshd PermitRootLogin disabled",
|
|
2227
2270
|
"impact": 0.7,
|
|
@@ -2261,7 +2304,6 @@
|
|
|
2261
2304
|
"disposition": "falsePositive"
|
|
2262
2305
|
},
|
|
2263
2306
|
{
|
|
2264
|
-
"$comment": "False positive (CVE scan) — vulnerability does not apply to this build",
|
|
2265
2307
|
"id": "CVE-2026-12345",
|
|
2266
2308
|
"title": "libxml2 buffer overflow in xmlParseEntityDecl",
|
|
2267
2309
|
"impact": 0.9,
|
|
@@ -2301,7 +2343,6 @@
|
|
|
2301
2343
|
"disposition": "falsePositive"
|
|
2302
2344
|
},
|
|
2303
2345
|
{
|
|
2304
|
-
"$comment": "Risk adjustment — impact lowered, pass/fail unchanged",
|
|
2305
2346
|
"id": "CVE-2026-67890",
|
|
2306
2347
|
"title": "OpenSSL timing side-channel in RSA decryption",
|
|
2307
2348
|
"impact": 0.7,
|
|
@@ -2344,7 +2385,6 @@
|
|
|
2344
2385
|
"disposition": "riskAdjustment"
|
|
2345
2386
|
},
|
|
2346
2387
|
{
|
|
2347
|
-
"$comment": "Operational requirement — cannot remediate, remains open risk",
|
|
2348
2388
|
"id": "SV-230500",
|
|
2349
2389
|
"title": "RHEL 9 must disable USB mass storage",
|
|
2350
2390
|
"impact": 0.5,
|
|
@@ -2384,7 +2424,6 @@
|
|
|
2384
2424
|
"disposition": "operationalRequirement"
|
|
2385
2425
|
},
|
|
2386
2426
|
{
|
|
2387
|
-
"$comment": "POAM — remediation tracked, status unchanged",
|
|
2388
2427
|
"id": "SV-230350",
|
|
2389
2428
|
"title": "RHEL 9 must be patched within 30 days of release",
|
|
2390
2429
|
"impact": 0.7,
|
|
@@ -2440,9 +2479,9 @@
|
|
|
2440
2479
|
}
|
|
2441
2480
|
}
|
|
2442
2481
|
},
|
|
2443
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.
|
|
2482
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0": {
|
|
2444
2483
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
2445
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.
|
|
2484
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/component/v3.7.0",
|
|
2446
2485
|
"title": "HDF Component Primitives",
|
|
2447
2486
|
"description": "First-class system component with identity, polymorphic type, generalized BOM attachment (boms[]), and system-binding properties. Components are the successor to Targets, adding stable identity (componentId), external system cross-references, and manifest inventory (SBOM, AI model/dataset, and reserved future BOM kinds).",
|
|
2448
2487
|
"$defs": {
|
|
@@ -2488,7 +2527,7 @@
|
|
|
2488
2527
|
"description": "Description of this component's role or purpose."
|
|
2489
2528
|
},
|
|
2490
2529
|
"owner": {
|
|
2491
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2530
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
|
|
2492
2531
|
"description": "Team or individual responsible for this component. Enables per-component ownership when different teams manage different parts of a system."
|
|
2493
2532
|
},
|
|
2494
2533
|
"externalIds": {
|
|
@@ -2508,14 +2547,14 @@
|
|
|
2508
2547
|
"boms": {
|
|
2509
2548
|
"type": "array",
|
|
2510
2549
|
"items": {
|
|
2511
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.
|
|
2550
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.7.0#/$defs/Bom"
|
|
2512
2551
|
},
|
|
2513
2552
|
"description": "Component-scoped Bills of Materials (SBOM, ai-model, dataset, or any reserved bomType), each carried by passthrough (ref/document) or normalized. Replaces the former sbom/sbomRef/sbomFormat trio; a component may carry several BOMs (e.g. an SBOM plus an ai-model BOM). See primitives/bom.schema.json."
|
|
2514
2553
|
},
|
|
2515
2554
|
"integrity": {
|
|
2516
2555
|
"type": "array",
|
|
2517
2556
|
"items": {
|
|
2518
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2557
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum"
|
|
2519
2558
|
},
|
|
2520
2559
|
"description": "Cryptographic integrity of this component's underlying artifact — model weights or shards, dataset archive, container image, or package bytes.\n\nAn array supports multi-file/sharded artifacts.\n\nThis is the single, generic home for artifact/subject integrity across all component types (it replaced the former per-type Container_Image digest and Artifact checksum fields).\n\nDistinct from BOM-document integrity (Bom.hashes[]) and from the document tamper-evidence Integrity type."
|
|
2521
2560
|
},
|
|
@@ -2529,12 +2568,12 @@
|
|
|
2529
2568
|
"inputOverrides": {
|
|
2530
2569
|
"type": "array",
|
|
2531
2570
|
"items": {
|
|
2532
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.
|
|
2571
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.7.0#/$defs/Input_Override"
|
|
2533
2572
|
},
|
|
2534
2573
|
"description": "System-specific overrides for baseline input values."
|
|
2535
2574
|
},
|
|
2536
2575
|
"targetSelector": {
|
|
2537
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.
|
|
2576
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.7.0#/$defs/Target_Selector",
|
|
2538
2577
|
"description": "Label selector to match targets belonging to this component during migration. Targets with matching labels are automatically included."
|
|
2539
2578
|
}
|
|
2540
2579
|
},
|
|
@@ -2665,9 +2704,9 @@
|
|
|
2665
2704
|
}
|
|
2666
2705
|
}
|
|
2667
2706
|
],
|
|
2707
|
+
"$comment": "Examples, in order: 1) Domain-joined host carrying all three identity fields separately: short hostname, FQDN, and the (distinct) directory domain. HOST_NAME and HOST_FQDN from a STIG checklist map here; note the AD domain differs from the FQDN's DNS suffix; 2) Standalone/workgroup host: has a short hostname but no directory domain — 'domain' is omitted rather than fabricated from the FQDN suffix.",
|
|
2668
2708
|
"examples": [
|
|
2669
2709
|
{
|
|
2670
|
-
"$comment": "Domain-joined host carrying all three identity fields separately: short hostname, FQDN, and the (distinct) directory domain. HOST_NAME and HOST_FQDN from a STIG checklist map here; note the AD domain differs from the FQDN's DNS suffix.",
|
|
2671
2710
|
"type": "host",
|
|
2672
2711
|
"name": "web-server-prod-01",
|
|
2673
2712
|
"componentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
|
|
@@ -2683,7 +2722,6 @@
|
|
|
2683
2722
|
}
|
|
2684
2723
|
},
|
|
2685
2724
|
{
|
|
2686
|
-
"$comment": "Standalone/workgroup host: has a short hostname but no directory domain — 'domain' is omitted rather than fabricated from the FQDN suffix.",
|
|
2687
2725
|
"type": "host",
|
|
2688
2726
|
"name": "kiosk-lab-07",
|
|
2689
2727
|
"hostname": "kiosk-lab-07",
|
|
@@ -2818,7 +2856,7 @@
|
|
|
2818
2856
|
"const": "cloudAccount"
|
|
2819
2857
|
},
|
|
2820
2858
|
"provider": {
|
|
2821
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2859
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Cloud_Provider",
|
|
2822
2860
|
"description": "Cloud provider."
|
|
2823
2861
|
},
|
|
2824
2862
|
"accountId": {
|
|
@@ -2857,7 +2895,7 @@
|
|
|
2857
2895
|
"const": "cloudResource"
|
|
2858
2896
|
},
|
|
2859
2897
|
"provider": {
|
|
2860
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
2898
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Cloud_Provider",
|
|
2861
2899
|
"description": "Cloud provider."
|
|
2862
2900
|
},
|
|
2863
2901
|
"resourceType": {
|
|
@@ -3156,9 +3194,9 @@
|
|
|
3156
3194
|
}
|
|
3157
3195
|
}
|
|
3158
3196
|
},
|
|
3159
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.
|
|
3197
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.7.0": {
|
|
3160
3198
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3161
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.
|
|
3199
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/bom/v3.7.0",
|
|
3162
3200
|
"title": "HDF BOM Primitives",
|
|
3163
3201
|
"description": "Generalized Bill-of-Materials / manifest representation.\n\nOne extensible Bom shape, discriminated by bomType, carries any manifest kind (SBOM, AI model/dataset, and reserved future kinds) either by passthrough (opaque ref/embed of the native document) or normalized (converted into HDF's queryable shape).\n\nSubject identity (name, version, componentId) is inherited from the host component or system — the BOM never re-owns it.\n\nSee ADR-0001.",
|
|
3164
3202
|
"$defs": {
|
|
@@ -3214,7 +3252,7 @@
|
|
|
3214
3252
|
"hashes": {
|
|
3215
3253
|
"type": "array",
|
|
3216
3254
|
"items": {
|
|
3217
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
3255
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum"
|
|
3218
3256
|
},
|
|
3219
3257
|
"description": "Integrity of the carried BOM *document* itself (the referenced/embedded manifest file), NOT the integrity of the BOM's subject artifact. Subject/artifact integrity (model weights, dataset archive) is a component-level concern, not carried here. Subject identity is inherited from the host component/system; per-node identity lives in the type-extension."
|
|
3220
3258
|
},
|
|
@@ -3331,9 +3369,9 @@
|
|
|
3331
3369
|
]
|
|
3332
3370
|
}
|
|
3333
3371
|
],
|
|
3372
|
+
"$comment": "Examples, in order: 1) Passthrough SBOM by external reference — the universal escape hatch, available to every bomType; 2) Passthrough for a reserved-but-not-yet-normalized type (cbom) — carried opaquely until a normalized extension ships; 3) Normalized ai-model BOM: CISA/G7-aligned fields live in the model extension, never at the component root or shared base; 4) Normalized dataset BOM with lineage — a filtered derivative of a base dataset, referenced by an ai-model via datasetRefs.",
|
|
3334
3373
|
"examples": [
|
|
3335
3374
|
{
|
|
3336
|
-
"$comment": "Passthrough SBOM by external reference — the universal escape hatch, available to every bomType.",
|
|
3337
3375
|
"bomType": "sbom",
|
|
3338
3376
|
"format": "cyclonedx",
|
|
3339
3377
|
"ref": "https://artifacts.agency.gov/sbom/webtier.cdx.json",
|
|
@@ -3345,7 +3383,6 @@
|
|
|
3345
3383
|
]
|
|
3346
3384
|
},
|
|
3347
3385
|
{
|
|
3348
|
-
"$comment": "Passthrough for a reserved-but-not-yet-normalized type (cbom) — carried opaquely until a normalized extension ships.",
|
|
3349
3386
|
"bomType": "cbom",
|
|
3350
3387
|
"format": "cyclonedx",
|
|
3351
3388
|
"document": {
|
|
@@ -3354,7 +3391,6 @@
|
|
|
3354
3391
|
}
|
|
3355
3392
|
},
|
|
3356
3393
|
{
|
|
3357
|
-
"$comment": "Normalized ai-model BOM: CISA/G7-aligned fields live in the model extension, never at the component root or shared base.",
|
|
3358
3394
|
"bomType": "ai-model",
|
|
3359
3395
|
"format": "cyclonedx-ml",
|
|
3360
3396
|
"model": {
|
|
@@ -3394,7 +3430,6 @@
|
|
|
3394
3430
|
}
|
|
3395
3431
|
},
|
|
3396
3432
|
{
|
|
3397
|
-
"$comment": "Normalized dataset BOM with lineage — a filtered derivative of a base dataset, referenced by an ai-model via datasetRefs.",
|
|
3398
3433
|
"bomType": "dataset",
|
|
3399
3434
|
"format": "croissant",
|
|
3400
3435
|
"dataset": {
|
|
@@ -3629,9 +3664,9 @@
|
|
|
3629
3664
|
}
|
|
3630
3665
|
}
|
|
3631
3666
|
},
|
|
3632
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.
|
|
3667
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.7.0": {
|
|
3633
3668
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3634
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.
|
|
3669
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/system/v3.7.0",
|
|
3635
3670
|
"title": "HDF System Primitives",
|
|
3636
3671
|
"description": "Types for describing system architecture, authorization boundaries, and components.",
|
|
3637
3672
|
"$defs": {
|
|
@@ -3682,7 +3717,7 @@
|
|
|
3682
3717
|
"description": "Rationale for why this override is needed."
|
|
3683
3718
|
},
|
|
3684
3719
|
"approvedBy": {
|
|
3685
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
3720
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
|
|
3686
3721
|
"description": "Identity of the person or system that approved this override."
|
|
3687
3722
|
}
|
|
3688
3723
|
},
|
|
@@ -3764,9 +3799,9 @@
|
|
|
3764
3799
|
}
|
|
3765
3800
|
}
|
|
3766
3801
|
},
|
|
3767
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.
|
|
3802
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.7.0": {
|
|
3768
3803
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3769
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.
|
|
3804
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/statistics/v3.7.0",
|
|
3770
3805
|
"title": "HDF Statistics Primitives",
|
|
3771
3806
|
"description": "Statistics types for tracking assessment run metrics.",
|
|
3772
3807
|
"$defs": {
|
|
@@ -3835,9 +3870,9 @@
|
|
|
3835
3870
|
}
|
|
3836
3871
|
}
|
|
3837
3872
|
},
|
|
3838
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.
|
|
3873
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0": {
|
|
3839
3874
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3840
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.
|
|
3875
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/extensions/v3.7.0",
|
|
3841
3876
|
"title": "HDF Extension Primitives",
|
|
3842
3877
|
"description": "Extension types for waivers, attestations, generators, and integrity.",
|
|
3843
3878
|
"$defs": {
|
|
@@ -3867,20 +3902,20 @@
|
|
|
3867
3902
|
"externalReferences": {
|
|
3868
3903
|
"type": "array",
|
|
3869
3904
|
"items": {
|
|
3870
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
3905
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"
|
|
3871
3906
|
},
|
|
3872
3907
|
"description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object or CTI feed motivating an E:A riskAdjustment). Inert context distinct from `evidence`; see External_Reference. Symmetric with Standalone_Override.externalReferences for the inline (results-embedded) override carrier."
|
|
3873
3908
|
},
|
|
3874
3909
|
"type": {
|
|
3875
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.
|
|
3910
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Override_Type",
|
|
3876
3911
|
"description": "The type of override applied to this requirement."
|
|
3877
3912
|
},
|
|
3878
3913
|
"status": {
|
|
3879
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.
|
|
3914
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status",
|
|
3880
3915
|
"description": "The new status this override sets for the requirement. Optional when only impact is being overridden."
|
|
3881
3916
|
},
|
|
3882
3917
|
"impact": {
|
|
3883
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.
|
|
3918
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Impact_Override",
|
|
3884
3919
|
"description": "Override to the requirement's impact score. At least one of status or impact must be set."
|
|
3885
3920
|
},
|
|
3886
3921
|
"reason": {
|
|
@@ -3888,7 +3923,7 @@
|
|
|
3888
3923
|
"description": "Explanation for why this override was applied."
|
|
3889
3924
|
},
|
|
3890
3925
|
"appliedBy": {
|
|
3891
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
3926
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
|
|
3892
3927
|
"description": "Identity of who applied this override. For simple cases, use type 'simple' with just an identifier."
|
|
3893
3928
|
},
|
|
3894
3929
|
"appliedAt": {
|
|
@@ -3902,30 +3937,31 @@
|
|
|
3902
3937
|
"description": "Timestamp when this override expires and must be reviewed/renewed. REQUIRED - no permanent overrides allowed. ISO 8601 format."
|
|
3903
3938
|
},
|
|
3904
3939
|
"signature": {
|
|
3905
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
3940
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature",
|
|
3906
3941
|
"description": "Optional digital signature for enhanced trust and non-repudiation. Supports hardware security tokens (PKCS#11/PKCS#12), Yubikeys, GPG keys, passkeys, and other signing methods."
|
|
3907
3942
|
},
|
|
3908
3943
|
"evidence": {
|
|
3909
3944
|
"type": "array",
|
|
3910
3945
|
"items": {
|
|
3911
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
3946
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"
|
|
3912
3947
|
},
|
|
3913
3948
|
"description": "Supporting evidence for this override, such as screenshots demonstrating manual verification for attestations."
|
|
3914
3949
|
},
|
|
3915
3950
|
"previousChecksum": {
|
|
3916
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
3951
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
|
|
3917
3952
|
"description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
|
|
3918
3953
|
},
|
|
3919
3954
|
"cvss": {
|
|
3920
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.
|
|
3955
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0#/$defs/Cvss",
|
|
3921
3956
|
"$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
|
|
3922
3957
|
"description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
|
|
3923
3958
|
},
|
|
3924
3959
|
"justification": {
|
|
3925
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.
|
|
3960
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0#/$defs/Justification",
|
|
3926
3961
|
"description": "Structured controlled-vocabulary classification for why this override applies. Complements (does not replace) the free-text 'reason' field. Most useful on falsePositive and attestation overrides where the structured category enables filtering and lossless round-trip with VEX / OSCAL / FedRAMP DR. See the Justification primitive for the precedent vocabulary and rationale."
|
|
3927
3962
|
}
|
|
3928
3963
|
},
|
|
3964
|
+
"$comment": "Example 3: Inline riskAdjustment carrying the STIX source that motivated it via externalReferences (the enrichment envelope, with the raw sighting embedded losslessly in document). This is the shape the enrich pass writes onto Evaluated_Requirement.overrides[] for the E:A recompute.",
|
|
3929
3965
|
"examples": [
|
|
3930
3966
|
{
|
|
3931
3967
|
"type": "waiver",
|
|
@@ -3952,7 +3988,6 @@
|
|
|
3952
3988
|
"expiresAt": "2026-10-14T00:00:00Z"
|
|
3953
3989
|
},
|
|
3954
3990
|
{
|
|
3955
|
-
"$comment": "Inline riskAdjustment carrying the STIX source that motivated it via externalReferences (the enrichment envelope, with the raw sighting embedded losslessly in document). This is the shape the enrich pass writes onto Evaluated_Requirement.overrides[] for the E:A recompute.",
|
|
3956
3991
|
"type": "riskAdjustment",
|
|
3957
3992
|
"impact": {
|
|
3958
3993
|
"value": 0.9
|
|
@@ -4015,7 +4050,7 @@
|
|
|
4015
4050
|
"evidence": [
|
|
4016
4051
|
{
|
|
4017
4052
|
"type": "screenshot",
|
|
4018
|
-
"data": "
|
|
4053
|
+
"data": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==",
|
|
4019
4054
|
"description": "Screenshot showing firewall configuration",
|
|
4020
4055
|
"mimeType": "image/png",
|
|
4021
4056
|
"encoding": "base64",
|
|
@@ -4058,7 +4093,7 @@
|
|
|
4058
4093
|
"description": "Detailed explanation of the plan, including what actions will be taken."
|
|
4059
4094
|
},
|
|
4060
4095
|
"appliedBy": {
|
|
4061
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4096
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
|
|
4062
4097
|
"description": "Identity of who created this POA&M. For simple cases, use type 'simple' with just an identifier."
|
|
4063
4098
|
},
|
|
4064
4099
|
"appliedAt": {
|
|
@@ -4074,23 +4109,23 @@
|
|
|
4074
4109
|
"milestones": {
|
|
4075
4110
|
"type": "array",
|
|
4076
4111
|
"items": {
|
|
4077
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4112
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Milestone"
|
|
4078
4113
|
},
|
|
4079
4114
|
"description": "Optional array of milestones tracking progress toward completion."
|
|
4080
4115
|
},
|
|
4081
4116
|
"signature": {
|
|
4082
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4117
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature",
|
|
4083
4118
|
"description": "Optional digital signature for enhanced trust and non-repudiation."
|
|
4084
4119
|
},
|
|
4085
4120
|
"evidence": {
|
|
4086
4121
|
"type": "array",
|
|
4087
4122
|
"items": {
|
|
4088
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4123
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"
|
|
4089
4124
|
},
|
|
4090
4125
|
"description": "Supporting evidence for this POA&M, such as documentation of compensating controls or mitigation implementation."
|
|
4091
4126
|
},
|
|
4092
4127
|
"previousChecksum": {
|
|
4093
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4128
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
|
|
4094
4129
|
"description": "SHA-256 checksum of the previous amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment on a requirement."
|
|
4095
4130
|
}
|
|
4096
4131
|
},
|
|
@@ -4243,7 +4278,7 @@
|
|
|
4243
4278
|
},
|
|
4244
4279
|
"properties": {
|
|
4245
4280
|
"algorithm": {
|
|
4246
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4281
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Hash_Algorithm",
|
|
4247
4282
|
"description": "The hash algorithm used for the checksum."
|
|
4248
4283
|
},
|
|
4249
4284
|
"checksum": {
|
|
@@ -4276,9 +4311,9 @@
|
|
|
4276
4311
|
}
|
|
4277
4312
|
}
|
|
4278
4313
|
},
|
|
4279
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.
|
|
4314
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0": {
|
|
4280
4315
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
4281
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.
|
|
4316
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/amendments/v3.7.0",
|
|
4282
4317
|
"title": "HDF Amendment Primitives",
|
|
4283
4318
|
"description": "Types for waivers, attestations, and POA&Ms that modify requirement compliance status.",
|
|
4284
4319
|
"$defs": {
|
|
@@ -4389,7 +4424,7 @@
|
|
|
4389
4424
|
"externalReferences": {
|
|
4390
4425
|
"type": "array",
|
|
4391
4426
|
"items": {
|
|
4392
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4427
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/External_Reference"
|
|
4393
4428
|
},
|
|
4394
4429
|
"description": "Optional references to the external artifacts behind this override (e.g. the STIX bundle/object, advisory, or CTI feed that motivated it). Inert context distinct from `evidence`; see External_Reference."
|
|
4395
4430
|
},
|
|
@@ -4399,6 +4434,7 @@
|
|
|
4399
4434
|
},
|
|
4400
4435
|
"requirementId": {
|
|
4401
4436
|
"type": "string",
|
|
4437
|
+
"minLength": 1,
|
|
4402
4438
|
"description": "The ID of the requirement being amended. Must match a requirement ID in the referenced baseline."
|
|
4403
4439
|
},
|
|
4404
4440
|
"baselineRef": {
|
|
@@ -4406,7 +4442,7 @@
|
|
|
4406
4442
|
"description": "Name of the baseline containing the requirement. Required when the system has multiple baselines with potentially overlapping requirement IDs."
|
|
4407
4443
|
},
|
|
4408
4444
|
"status": {
|
|
4409
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.
|
|
4445
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/result/v3.7.0#/$defs/Result_Status",
|
|
4410
4446
|
"description": "The new status this amendment sets. Optional when only impact is being overridden."
|
|
4411
4447
|
},
|
|
4412
4448
|
"impact": {
|
|
@@ -4418,7 +4454,7 @@
|
|
|
4418
4454
|
"description": "Justification for this amendment."
|
|
4419
4455
|
},
|
|
4420
4456
|
"appliedBy": {
|
|
4421
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4457
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
|
|
4422
4458
|
"description": "Identity of who applied this amendment."
|
|
4423
4459
|
},
|
|
4424
4460
|
"appliedAt": {
|
|
@@ -4434,20 +4470,20 @@
|
|
|
4434
4470
|
"evidence": {
|
|
4435
4471
|
"type": "array",
|
|
4436
4472
|
"items": {
|
|
4437
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4473
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Evidence"
|
|
4438
4474
|
},
|
|
4439
4475
|
"description": "Supporting evidence (screenshots, logs, URLs, documents)."
|
|
4440
4476
|
},
|
|
4441
4477
|
"signature": {
|
|
4442
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4478
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Signature",
|
|
4443
4479
|
"description": "Digital signature for non-repudiation."
|
|
4444
4480
|
},
|
|
4445
4481
|
"previousChecksum": {
|
|
4446
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4482
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Checksum",
|
|
4447
4483
|
"description": "SHA-256 checksum of the prior amendment in chronological order. Each amendment's checksum is recorded by the NEXT one, so editing an amendment in place is detectable — provided a later amendment is chained to it. It is NOT tamper-proof: the final amendment, the document envelope, deleted trailing amendments, and a chain that has been stripped or recomputed wholesale are all outside what it can detect. Use signature for non-repudiation. Omitted on the first amendment."
|
|
4448
4484
|
},
|
|
4449
4485
|
"cvss": {
|
|
4450
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.
|
|
4486
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0#/$defs/Cvss",
|
|
4451
4487
|
"$comment": "When present alongside impact.value on a riskAdjustment override, impact.value should be approximately cvss.computedScore / 10.0. Soft consistency rule — validators may warn but should not error. The cvss block makes Environmental/Threat enrichment auditable.",
|
|
4452
4488
|
"description": "Structured CVSS scoring data backing this override. Captures the rubric (which Environmental/Threat metrics the consumer modified, the recomputed score) used to justify a riskAdjustment. For other override types this is optional context."
|
|
4453
4489
|
},
|
|
@@ -4458,7 +4494,7 @@
|
|
|
4458
4494
|
"milestones": {
|
|
4459
4495
|
"type": "array",
|
|
4460
4496
|
"items": {
|
|
4461
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
4497
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Milestone"
|
|
4462
4498
|
},
|
|
4463
4499
|
"description": "Remediation milestones (primarily for POA&M type amendments)."
|
|
4464
4500
|
},
|
|
@@ -4475,11 +4511,12 @@
|
|
|
4475
4511
|
"affectedPackages": {
|
|
4476
4512
|
"type": "array",
|
|
4477
4513
|
"items": {
|
|
4478
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.
|
|
4514
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0#/$defs/Affected_Package"
|
|
4479
4515
|
},
|
|
4480
4516
|
"description": "Software packages this amendment is scoped to, distinct from componentRef (which scopes to an HDF-internal Component by UUID).\n\nUse when the source amendment format references packages by purl/cpe/name+version — e.g., VEX `affects[]` / `products[]`, OSCAL POA&M `subjects[]`, FedRAMP component-aware amendments.\n\nSymmetric with Evaluated_Requirement.affectedPackages, which scopes findings to the same package vocabulary.\n\nWhen omitted, the amendment applies system-wide (or only to componentRef when that is set)."
|
|
4481
4517
|
}
|
|
4482
4518
|
},
|
|
4519
|
+
"$comment": "Example 7: VEX-style import — falsePositive scoped to specific packages by purl. The affectedPackages array carries structured product identity instead of squeezing 'Products: …' into the reason free-text field.",
|
|
4483
4520
|
"examples": [
|
|
4484
4521
|
{
|
|
4485
4522
|
"type": "waiver",
|
|
@@ -4581,7 +4618,6 @@
|
|
|
4581
4618
|
"expiresAt": "2026-09-26T00:00:00Z"
|
|
4582
4619
|
},
|
|
4583
4620
|
{
|
|
4584
|
-
"$comment": "VEX-style import — falsePositive scoped to specific packages by purl. The affectedPackages array carries structured product identity instead of squeezing 'Products: …' into the reason free-text field.",
|
|
4585
4621
|
"type": "falsePositive",
|
|
4586
4622
|
"requirementId": "CVE-2026-12345",
|
|
4587
4623
|
"status": "notApplicable",
|
|
@@ -4608,9 +4644,9 @@
|
|
|
4608
4644
|
}
|
|
4609
4645
|
}
|
|
4610
4646
|
},
|
|
4611
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.
|
|
4647
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0": {
|
|
4612
4648
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
4613
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.
|
|
4649
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/cvss/v3.7.0",
|
|
4614
4650
|
"title": "HDF CVSS Primitives",
|
|
4615
4651
|
"description": "Types for representing CVSS (Common Vulnerability Scoring System) data attached to assessment findings. Supports CVSS v2.0, v3.0, v3.1, and v4.0 metric groups (Base, Threat, Environmental, Supplemental).",
|
|
4616
4652
|
"$defs": {
|
|
@@ -4674,7 +4710,7 @@
|
|
|
4674
4710
|
]
|
|
4675
4711
|
}
|
|
4676
4712
|
],
|
|
4677
|
-
"$comment": "Only `version` is required; every metric/score field is optional because a single Cvss instance may represent vendor-supplied Base data (on a finding's cvss[]), consumer-supplied enrichment (on a riskAdjustment override — Environmental/Threat/Supplemental deltas with NO base, since base is the finding's scan-specific vendor data), or a fully-resolved effectiveCvss. The Base/Threat/Environmental/Supplemental groups do not partition cleanly into vendor-vs-consumer (Threat straddles: vendor temporal data and consumer exploit-maturity both live here), so a single permissive type is more honest than separate vendor/consumer types. The anyOf guardrail rejects a content-free object (e.g. {version} alone) by requiring at least one substantive metric or score. baseVector remains optional even when baseScore is present: some vendor tools (Twistlock/Prisma Cloud) emit a final score without the vector that derived it — that score is captured structurally rather than lost.",
|
|
4713
|
+
"$comment": "Only `version` is required; every metric/score field is optional because a single Cvss instance may represent vendor-supplied Base data (on a finding's cvss[]), consumer-supplied enrichment (on a riskAdjustment override — Environmental/Threat/Supplemental deltas with NO base, since base is the finding's scan-specific vendor data), or a fully-resolved effectiveCvss. The Base/Threat/Environmental/Supplemental groups do not partition cleanly into vendor-vs-consumer (Threat straddles: vendor temporal data and consumer exploit-maturity both live here), so a single permissive type is more honest than separate vendor/consumer types. The anyOf guardrail rejects a content-free object (e.g. {version} alone) by requiring at least one substantive metric or score. baseVector remains optional even when baseScore is present: some vendor tools (Twistlock/Prisma Cloud) emit a final score without the vector that derived it — that score is captured structurally rather than lost. Examples, in order: 1) Base-only: vendor-supplied CVSS 3.1 data exactly as a scanner (e.g., Nessus, Grype) would emit it. No consumer enrichment yet; 2) Base + Threat: consumer added Exploit Maturity ('E:U' = Unproven) and Remediation Level ('RL:O' = Official Fix) to a HTTP/2 'Rapid Reset' DoS finding. Threat score drops from base 7.5 to 5.5; 3) Base + Environmental: consumer asserts the affected system is high-criticality (CR:H, IR:H, AR:H) AND network-reachable in their environment (MAV:N). Environmental score reflects deployment risk for the xz-utils backdoor; 4) Full CVSS 4.0: vendor base + consumer threat (E:A = Attacked, exploits seen in the wild) + environmental (high CIA requirements) + supplemental context (S:P = present safety impact, AU:N = no autonomous spread, RE:M = moderate response effort) for the Fortinet FortiOS pre-auth RCE. computedScore reflects post-mitigation final risk; 5) CVSS 2.0 legacy: Heartbleed (CVE-2014-0160) as still reported by older scanner output and legacy NVD data. CVSS 2.0 vectors have no 'CVSS:2.0/' prefix.",
|
|
4678
4714
|
"properties": {
|
|
4679
4715
|
"version": {
|
|
4680
4716
|
"type": "string",
|
|
@@ -4754,7 +4790,6 @@
|
|
|
4754
4790
|
},
|
|
4755
4791
|
"examples": [
|
|
4756
4792
|
{
|
|
4757
|
-
"$comment": "Base-only: vendor-supplied CVSS 3.1 data exactly as a scanner (e.g., Nessus, Grype) would emit it. No consumer enrichment yet.",
|
|
4758
4793
|
"version": "3.1",
|
|
4759
4794
|
"source": "CVE-2024-12345",
|
|
4760
4795
|
"baseVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
@@ -4762,7 +4797,6 @@
|
|
|
4762
4797
|
"baseSeverity": "critical"
|
|
4763
4798
|
},
|
|
4764
4799
|
{
|
|
4765
|
-
"$comment": "Base + Threat: consumer added Exploit Maturity ('E:U' = Unproven) and Remediation Level ('RL:O' = Official Fix) to a HTTP/2 'Rapid Reset' DoS finding. Threat score drops from base 7.5 to 5.5.",
|
|
4766
4800
|
"version": "3.1",
|
|
4767
4801
|
"source": "CVE-2023-44487",
|
|
4768
4802
|
"baseVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
@@ -4772,7 +4806,6 @@
|
|
|
4772
4806
|
"threatScore": 5.5
|
|
4773
4807
|
},
|
|
4774
4808
|
{
|
|
4775
|
-
"$comment": "Base + Environmental: consumer asserts the affected system is high-criticality (CR:H, IR:H, AR:H) AND network-reachable in their environment (MAV:N). Environmental score reflects deployment risk for the xz-utils backdoor.",
|
|
4776
4809
|
"version": "3.1",
|
|
4777
4810
|
"source": "CVE-2024-3094",
|
|
4778
4811
|
"baseVector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
|
@@ -4784,7 +4817,6 @@
|
|
|
4784
4817
|
"computedSeverity": "critical"
|
|
4785
4818
|
},
|
|
4786
4819
|
{
|
|
4787
|
-
"$comment": "Full CVSS 4.0: vendor base + consumer threat (E:A = Attacked, exploits seen in the wild) + environmental (high CIA requirements) + supplemental context (S:P = present safety impact, AU:N = no autonomous spread, RE:M = moderate response effort) for the Fortinet FortiOS pre-auth RCE. computedScore reflects post-mitigation final risk.",
|
|
4788
4820
|
"version": "4.0",
|
|
4789
4821
|
"source": "CVE-2024-21762",
|
|
4790
4822
|
"baseVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
|
|
@@ -4799,7 +4831,6 @@
|
|
|
4799
4831
|
"computedSeverity": "medium"
|
|
4800
4832
|
},
|
|
4801
4833
|
{
|
|
4802
|
-
"$comment": "CVSS 2.0 legacy: Heartbleed (CVE-2014-0160) as still reported by older scanner output and legacy NVD data. CVSS 2.0 vectors have no 'CVSS:2.0/' prefix.",
|
|
4803
4834
|
"version": "2.0",
|
|
4804
4835
|
"source": "CVE-2014-0160",
|
|
4805
4836
|
"baseVector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
|
@@ -4812,9 +4843,9 @@
|
|
|
4812
4843
|
}
|
|
4813
4844
|
}
|
|
4814
4845
|
},
|
|
4815
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.
|
|
4846
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0": {
|
|
4816
4847
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
4817
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.
|
|
4848
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/affected-package/v3.7.0",
|
|
4818
4849
|
"title": "HDF Affected Package Primitives",
|
|
4819
4850
|
"description": "Types for representing the software package(s) affected by a vulnerability finding.",
|
|
4820
4851
|
"$defs": {
|
|
@@ -4880,9 +4911,9 @@
|
|
|
4880
4911
|
"description": "Optional version string identifying the first release that contains the fix for the vulnerability. Use the same version syntax as `version`. Example: '1.1.1l' fixes 'openssl@1.1.1k'."
|
|
4881
4912
|
}
|
|
4882
4913
|
},
|
|
4914
|
+
"$comment": "Examples, in order: 1) RPM ecosystem with full CPE + PURL — typical Grype/Trivy output for a RHEL host scan; 2) NPM ecosystem with PURL only — the JavaScript world rarely emits CPEs; PURL is the canonical identifier; 3) Minimal valid AffectedPackage — only the three required fields. Use when the scanner reports a package by name+version without emitting CPE or PURL strings; 4) Maven ecosystem with full identifiers + fixedInVersion — log4j Log4Shell-style finding showing the patch path from vulnerable to fixed; 5) purl-only — VEX import path where the source format gives a purl and we choose not to decompose it. Valid because purl encodes name/version/ecosystem implicitly; 6) cpe-only — NIST-flavored scopes where the consumer carries a CPE 2.3 string and no purl. Valid because cpe encodes vendor/product/version.",
|
|
4883
4915
|
"examples": [
|
|
4884
4916
|
{
|
|
4885
|
-
"$comment": "RPM ecosystem with full CPE + PURL — typical Grype/Trivy output for a RHEL host scan.",
|
|
4886
4917
|
"name": "openssl",
|
|
4887
4918
|
"version": "1.1.1k-7.el8_4",
|
|
4888
4919
|
"ecosystem": "rpm",
|
|
@@ -4891,7 +4922,6 @@
|
|
|
4891
4922
|
"fixedInVersion": "1.1.1l"
|
|
4892
4923
|
},
|
|
4893
4924
|
{
|
|
4894
|
-
"$comment": "NPM ecosystem with PURL only — the JavaScript world rarely emits CPEs; PURL is the canonical identifier.",
|
|
4895
4925
|
"name": "lodash",
|
|
4896
4926
|
"version": "4.17.20",
|
|
4897
4927
|
"ecosystem": "npm",
|
|
@@ -4899,13 +4929,11 @@
|
|
|
4899
4929
|
"fixedInVersion": "4.17.21"
|
|
4900
4930
|
},
|
|
4901
4931
|
{
|
|
4902
|
-
"$comment": "Minimal valid AffectedPackage — only the three required fields. Use when the scanner reports a package by name+version without emitting CPE or PURL strings.",
|
|
4903
4932
|
"name": "requests",
|
|
4904
4933
|
"version": "2.28.1",
|
|
4905
4934
|
"ecosystem": "pypi"
|
|
4906
4935
|
},
|
|
4907
4936
|
{
|
|
4908
|
-
"$comment": "Maven ecosystem with full identifiers + fixedInVersion — log4j Log4Shell-style finding showing the patch path from vulnerable to fixed.",
|
|
4909
4937
|
"name": "org.apache.logging.log4j:log4j-core",
|
|
4910
4938
|
"version": "2.14.1",
|
|
4911
4939
|
"ecosystem": "maven",
|
|
@@ -4914,11 +4942,9 @@
|
|
|
4914
4942
|
"fixedInVersion": "2.17.1"
|
|
4915
4943
|
},
|
|
4916
4944
|
{
|
|
4917
|
-
"$comment": "purl-only — VEX import path where the source format gives a purl and we choose not to decompose it. Valid because purl encodes name/version/ecosystem implicitly.",
|
|
4918
4945
|
"purl": "pkg:npm/lodash@4.17.20"
|
|
4919
4946
|
},
|
|
4920
4947
|
{
|
|
4921
|
-
"$comment": "cpe-only — NIST-flavored scopes where the consumer carries a CPE 2.3 string and no purl. Valid because cpe encodes vendor/product/version.",
|
|
4922
4948
|
"cpe": "cpe:2.3:a:openssl:openssl:1.1.1k:*:*:*:*:*:*:*"
|
|
4923
4949
|
}
|
|
4924
4950
|
],
|
|
@@ -4927,9 +4953,9 @@
|
|
|
4927
4953
|
}
|
|
4928
4954
|
}
|
|
4929
4955
|
},
|
|
4930
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.
|
|
4956
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.7.0": {
|
|
4931
4957
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
4932
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.
|
|
4958
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/runner/v3.7.0",
|
|
4933
4959
|
"title": "HDF Runner Primitive",
|
|
4934
4960
|
"description": "Information about the test execution environment where the security tool/scanner was executed.",
|
|
4935
4961
|
"$defs": {
|
|
@@ -4973,7 +4999,7 @@
|
|
|
4973
4999
|
"description": "The container instance identifier. Example: 'a1b2c3d4e5f6', 'security-scan-job-xyz123'. Can be a Docker container ID, Kubernetes pod name, or other container runtime identifier."
|
|
4974
5000
|
},
|
|
4975
5001
|
"operator": {
|
|
4976
|
-
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.
|
|
5002
|
+
"$ref": "https://mitre.github.io/hdf-libs/schemas/primitives/common/v3.7.0#/$defs/Identity",
|
|
4977
5003
|
"description": "The identity of the person or system responsible for executing the test. This could be a human auditor manually completing a checklist, an automated CI/CD system, or a security tool. Optional field to support both automated and manual HDF generation."
|
|
4978
5004
|
}
|
|
4979
5005
|
},
|
|
@@ -5022,9 +5048,9 @@
|
|
|
5022
5048
|
}
|
|
5023
5049
|
}
|
|
5024
5050
|
},
|
|
5025
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.
|
|
5051
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.7.0": {
|
|
5026
5052
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
5027
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.
|
|
5053
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/parameter/v3.7.0",
|
|
5028
5054
|
"title": "HDF Parameter Primitives",
|
|
5029
5055
|
"description": "Input/parameter type definitions for typed, traceable configuration values that bridge governance prose and scanner automation.",
|
|
5030
5056
|
"$defs": {
|
|
@@ -5155,9 +5181,9 @@
|
|
|
5155
5181
|
}
|
|
5156
5182
|
}
|
|
5157
5183
|
},
|
|
5158
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.
|
|
5184
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.7.0": {
|
|
5159
5185
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
5160
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.
|
|
5186
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/epss/v3.7.0",
|
|
5161
5187
|
"title": "HDF EPSS Primitive",
|
|
5162
5188
|
"description": "Type for representing FIRST.org's Exploit Prediction Scoring System (EPSS) data for a vulnerability. EPSS estimates the probability that a CVE will be exploited in the wild in the next 30 days. See https://www.first.org/epss/ for the underlying model and methodology.",
|
|
5163
5189
|
"$defs": {
|
|
@@ -5189,21 +5215,19 @@
|
|
|
5189
5215
|
"description": "ISO 8601 date (YYYY-MM-DD) on which FIRST.org published this EPSS score."
|
|
5190
5216
|
}
|
|
5191
5217
|
},
|
|
5218
|
+
"$comment": "Examples, in order: 1) High exploit probability and high percentile, characteristic of a widely-exploited vulnerability like Log4Shell (CVE-2021-44228) shortly after disclosure; 2) Low score but moderate percentile, the common case for CVEs that have some observed exploitation evidence but are not under active mass exploitation; 3) Very low score, typical of a CVE with no known exploitation activity or proof-of-concept availability.",
|
|
5192
5219
|
"examples": [
|
|
5193
5220
|
{
|
|
5194
|
-
"$comment": "High exploit probability and high percentile, characteristic of a widely-exploited vulnerability like Log4Shell (CVE-2021-44228) shortly after disclosure.",
|
|
5195
5221
|
"score": 0.97532,
|
|
5196
5222
|
"percentile": 0.99987,
|
|
5197
5223
|
"date": "2026-05-26"
|
|
5198
5224
|
},
|
|
5199
5225
|
{
|
|
5200
|
-
"$comment": "Low score but moderate percentile, the common case for CVEs that have some observed exploitation evidence but are not under active mass exploitation.",
|
|
5201
5226
|
"score": 0.04521,
|
|
5202
5227
|
"percentile": 0.78432,
|
|
5203
5228
|
"date": "2026-05-26"
|
|
5204
5229
|
},
|
|
5205
5230
|
{
|
|
5206
|
-
"$comment": "Very low score, typical of a CVE with no known exploitation activity or proof-of-concept availability.",
|
|
5207
5231
|
"score": 0.00042,
|
|
5208
5232
|
"percentile": 0.10215,
|
|
5209
5233
|
"date": "2026-05-26"
|
|
@@ -5214,9 +5238,9 @@
|
|
|
5214
5238
|
}
|
|
5215
5239
|
}
|
|
5216
5240
|
},
|
|
5217
|
-
"https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.
|
|
5241
|
+
"https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.7.0": {
|
|
5218
5242
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
5219
|
-
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.
|
|
5243
|
+
"$id": "https://mitre.github.io/hdf-libs/schemas/primitives/kev/v3.7.0",
|
|
5220
5244
|
"title": "HDF Kev Primitives",
|
|
5221
5245
|
"description": "Types for representing CISA Known Exploited Vulnerabilities (KEV) catalog membership. The KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) flags CVEs that are confirmed actively exploited in the wild and drives federal patching urgency under CISA Binding Operational Directive 22-01.",
|
|
5222
5246
|
"$defs": {
|
|
@@ -5262,23 +5286,21 @@
|
|
|
5262
5286
|
"description": "CISA's notes describing the vulnerability, observed exploitation, or remediation guidance."
|
|
5263
5287
|
}
|
|
5264
5288
|
},
|
|
5289
|
+
"$comment": "Examples, in order: 1) High-urgency case: recently added KEV entry with a short federal patching deadline; 2) Older KEV entry whose due date has already passed — useful for reporting overdue remediation; 3) Vulnerability evaluated against the KEV catalog and confirmed not present — dateAdded/dueDate are not required when inKev is false.",
|
|
5265
5290
|
"examples": [
|
|
5266
5291
|
{
|
|
5267
|
-
"$comment": "High-urgency case: recently added KEV entry with a short federal patching deadline.",
|
|
5268
5292
|
"inKev": true,
|
|
5269
5293
|
"dateAdded": "2026-03-15",
|
|
5270
5294
|
"dueDate": "2026-04-05",
|
|
5271
5295
|
"notes": "Active ransomware exploitation observed; apply vendor patch immediately."
|
|
5272
5296
|
},
|
|
5273
5297
|
{
|
|
5274
|
-
"$comment": "Older KEV entry whose due date has already passed — useful for reporting overdue remediation.",
|
|
5275
5298
|
"inKev": true,
|
|
5276
5299
|
"dateAdded": "2023-11-07",
|
|
5277
5300
|
"dueDate": "2023-11-28",
|
|
5278
5301
|
"notes": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."
|
|
5279
5302
|
},
|
|
5280
5303
|
{
|
|
5281
|
-
"$comment": "Vulnerability evaluated against the KEV catalog and confirmed not present — dateAdded/dueDate are not required when inKev is false.",
|
|
5282
5304
|
"inKev": false
|
|
5283
5305
|
}
|
|
5284
5306
|
],
|