vuln-policy.schema.json

{
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "title": "Policy",
    "type": "object",
    "properties": {
        "apiVersion": {
            "description": "API Version.",
            "type": "string"
        },
        "type": {
            "description": "Type of the policy.",
            "const": "Vulnerability Policy"
        },
        "name": {
            "description": "Name of the policy.",
            "type": "string",
            "minLength": 1,
            "maxLength": 255
        },
        "description": {
            "description": "Short description of the policy.",
            "type": "string",
            "minLength": 1,
            "maxLength": 512
        },
        "author": {
            "description": "Name of the policy author.",
            "type": "string",
            "minLength": 1,
            "maxLength": 255
        },
        "validFrom": {
            "description": "When the policy should take effect (in RFC3339 format).",
            "type": "string",
            "format": "date-time"
        },
        "validUntil": {
            "description": "Until when the policy should take effect (in RFC3339 format).",
            "type": "string",
            "format": "date-time"
        },
        "conditions": {
            "description": "1..N conditions as CEL expressions.",
            "type": "array",
            "items": {
                "type": "string"
            },
            "minItems": 1
        },
        "analysis": {
            "description": "The analysis to apply when all expressions match.",
            "type": "object",
            "properties": {
                "state": {
                    "description": "State of the analysis.",
                    "enum": [
                        "EXPLOITABLE",
                        "IN_TRIAGE",
                        "FALSE_POSITIVE",
                        "NOT_AFFECTED",
                        "RESOLVED"
                    ]
                },
                "justification": {
                    "description": "Justification for the state.",
                    "enum": [
                        "CODE_NOT_PRESENT",
                        "CODE_NOT_REACHABLE",
                        "REQUIRES_CONFIGURATION",
                        "REQUIRES_DEPENDENCY",
                        "REQUIRES_ENVIRONMENT",
                        "PROTECTED_BY_COMPILER",
                        "PROTECTED_AT_RUNTIME",
                        "PROTECTED_AT_PERIMETER",
                        "PROTECTED_BY_MITIGATING_CONTROL"
                    ]
                },
                "vendorResponse": {
                    "description": "What to communicate to consumers for this finding (from a vendor POV).",
                    "enum": [
                        "CAN_NOT_FIX",
                        "WILL_NOT_FIX",
                        "UPDATE",
                        "ROLLBACK",
                        "WORKAROUND_AVAILABLE"
                    ]
                },
                "details": {
                    "description": "Additional details about why this analysis was made.",
                    "type": "string"
                },
                "suppress": {
                    "description": "Whether to suppress the finding.",
                    "type": "boolean"
                }
            },
            "required": [
                "state"
            ]
        },
        "ratings": {
            "description": "0..3 ratings to apply to the finding when all expressions match.",
            "type": "array",
            "items": {
                "$ref": "#/$defs/rating"
            },
            "minItems": 0,
            "maxItems": 3
        },
        "operationMode": {
            "description": "Mode of operation for the vulnerability policy.",
            "enum": [
                "DISABLED",
                "APPLY",
                "LOG"
            ]
        }
    },
    "$defs": {
        "rating": {
            "type": "object",
            "properties": {
                "method": {
                    "description": "Methodology of the rating (e.g. CVSSv2, OWASP).",
                    "enum": [
                        "CVSSV2",
                        "CVSSV3",
                        "CVSSV31",
                        "OWASP"
                    ]
                },
                "severity": {
                    "description": "Severity (LOW, MEDIUM, etc.).",
                    "enum": [
                        "CRITICAL",
                        "HIGH",
                        "MEDIUM",
                        "LOW",
                        "INFO",
                        "UNASSIGNED"
                    ]
                },
                "vector": {
                    "description": "Vector of the method.",
                    "type": "string",
                    "pattern": "(SL:\\d/M:\\d/O:\\d/S:\\d/ED:\\d/EE:\\d/A:\\d/ID:\\d/LC:\\d/LI:\\d/LAV:\\d/LAC:\\d/FD:\\d/RD:\\d/NC:\\d/PV:\\d)|(AV:(N|A|L)\\/AC:(L|M|H)\\/A[Uu]:(N|S|M)\\/C:(N|P|C)\\/I:(N|P|C)\\/A:(N|P|C)|AV:(N|A|L|P)\\/AC:(L|H)\\/PR:(N|L|H)\\/UI:(N|R)\\/S:(U|C)\\/C:(N|L|H)\\/I:(N|L|H)\\/A:(N|L|H))|(AV:(N|A|L|P)\\/AC:(L|H)\\/PR:(N|L|H)\\/UI:(N|R)\\/S:(U|C)\\/C:(N|L|H)\\/I:(N|L|H)\\/A:(N|L|H)\\/E:(F|H|U|P|X)\\/RL:(W|U|T|O|X)\\/RC:(C|R|U|X)\\/CR:(X|L|M|H)\\/IR:(X|L|M|H)\\/AR:(X|L|M|H)\\/MAV:(X|N|A|L|P)\\/MAC:(X|L|H)\\/MPR:(X|N|L|H)\\/MUI:(X|N|R)\\/MS:(X|U|C)\\/MC:(X|N|L|H)\\/MI:(X|N|L|H)\\/MA:(X|N|L|H))"
                },
                "score": {
                    "description": "Numeric score for the method.",
                    "type": "number"
                }
            },
            "required": [
                "method",
                "severity"
            ]
        }
    },
    "required": [
        "apiVersion",
        "type",
        "name",
        "conditions",
        "analysis",
        "operationMode"
    ],
    "additionalProperties": false
}