Published Schema

[jcran]

Is there a public & authoritative schema somewhere for the vulnrichment ADP fields? building some validation and just looking for an authoritative source.

[jwoytek-cisa]

@jcran apologies for the delayed response.

Vulnrichment ADP conforms to the CVE JSON Schema. All ADP records should validate against that at a minimum. The "custom" data that we provide are KEV presence and SSVC score.

The KEV schema is available here: https://github.com/cisagov/vulnrichment/blob/develop/assets/kev_metrics_schema-1.0.json

The SSVC score data conforms to the SSVC JSON schema version 2.0, which aligns with the decision tree in use to calculate those scores. That schema can be found here: https://github.com/CERTCC/SSVC/blob/v2.0/data/schema/SSVC_Computed_v2.01.schema.json

We don't have a unified schema available. I am going to leave this issue open for some internal discussion on allocating time to developing one.

[jcran]

Super helpful, thanks for the quick response. General ask is that each ADP owns their entire schema, and that MITRE gives the section to the ADP to define the schema and own changes. if an ADP introduces a breaking change they need to wait to be included in next MITRE-defined major rev change. kinda semantic versioning at scale / federated. Happy to talk more about this if i can be helpful, but i suspect you get it. thanks for the work to improve cve records.

[amanion-cisa]

Hi @jcran, so ADP is still under some degree of policy and process development by the CVE Program. Generally, the idea is as you described, ADPs are approved and must provide schema for provided data that does not directly fit in the CVE Record Format. Exactly how to do that remains somewhat undefined, specifically, there's been no decision to tie ADP schema versions/changes to CVE Record Format versions/changes. The vulnrichment ADP does what @jwoytek-cisa wrote (specifies KEV, imports specific version of SSVC). The CVE Program ADP works fully within the CVE Record Format schema.

You might want to raise this (the bigger ADP schema question) at https://github.com/CVEProject/cve-schema/issues.