Published Schema

[jcran]

Is there a public & authoritative schema somewhere for the vulnrichment ADP fields? building some validation and just looking for an authoritative source.

[jwoytek-cisa]

@jcran apologies for the delayed response.

Vulnrichment ADP conforms to the CVE JSON Schema. All ADP records should validate against that at a minimum. The "custom" data that we provide are KEV presence and SSVC score.

The KEV schema is available here: https://github.com/cisagov/vulnrichment/blob/develop/assets/kev_metrics_schema-1.0.json

The SSVC score data conforms to the SSVC JSON schema version 2.0, which aligns with the decision tree in use to calculate those scores. That schema can be found here: https://github.com/CERTCC/SSVC/blob/v2.0/data/schema/SSVC_Computed_v2.01.schema.json

We don't have a unified schema available. I am going to leave this issue open for some internal discussion on allocating time to developing one.

[jcran]

Super helpful, thanks for the quick response. General ask is that each ADP owns their entire schema, and that MITRE gives the section to the ADP to define the schema and own changes. if an ADP introduces a breaking change they need to wait to be included in next MITRE-defined major rev change. kinda semantic versioning at scale / federated. Happy to talk more about this if i can be helpful, but i suspect you get it. thanks for the work to improve cve records.

[amanion-cisa]

Hi @jcran, so ADP is still under some degree of policy and process development by the CVE Program. Generally, the idea is as you described, ADPs are approved and must provide schema for provided data that does not directly fit in the CVE Record Format. Exactly how to do that remains somewhat undefined, specifically, there's been no decision to tie ADP schema versions/changes to CVE Record Format versions/changes. The vulnrichment ADP does what @jwoytek-cisa wrote (specifies KEV, imports specific version of SSVC). The CVE Program ADP works fully within the CVE Record Format schema.

You might want to raise this (the bigger ADP schema question) at https://github.com/CVEProject/cve-schema/issues.

[sei-vsarvepalli]

Please note that the SSVC schema has been updated a couple of times since the old versions - the latest that is also planned to be part of a CSAF record is here - https://github.com/CERTCC/SSVC/blob/main/data/schema/v2/Decision_Point_Value_Selection-2-0-0.schema.json -

[pNm193]

Is there a public & authoritative schema somewhere for the vulnrichment ADP fields? building some validation and just looking for an authoritative source.

ADP .. midwest?

[amanion-cisa]

@pNm193 please do not post spurious or off-topic comments or issues (like #182), this behavior is not helpful.

ADP is an acronym for Authorized Data Publisher, a specific role in the CVE Program.

[pNm193]

Like council of roots??

Im sorry. Wasn't intended to upset anyone with a question..How is someone still learning the ins and outs supposed to learn and remember everything without asking questions..