| Attribute name | -Type | -Description | -
|---|---|---|
additional_resources |
- array (object) | -Path: @additional_resourcesAdditional resources. For example, an AWS EC2 instance can have security groups and Auto Scaling groups as additional resources. |
-
base_severity |
- string | -Path: @base_severityBase severity level of the finding before any adjustments. Valid values: critical, high, medium, low, info, none, unknown. |
-
description |
- string | -Path: @descriptionHuman-readable explanation of the finding. May include Markdown formatting. |
-
detection_changed_at |
- integer | -Path: @detection_changed_atTimestamp in milliseconds (UTC) when the finding's evaluation or detection state last changed. |
-
exposure_time_seconds |
- integer | -Path: @exposure_time_secondsIndicates the time elapsed, in seconds, between when the finding was last closed and when it was first detected. |
-
finding_id |
- string | -Path: @finding_idUnique identifier of the finding. |
-
finding_type |
- string | -Path: @finding_typeCategory of the finding. Valid values: api_security, attack_path, runtime_code_vulnerability, static_code_vulnerability, host_and_container_vulnerability, iac_misconfiguration, identity_risk, library_vulnerability, misconfiguration, secret, workload_activity, sensitive_data. |
-
first_seen_at |
- integer | -Path: @first_seen_atTimestamp in milliseconds (UTC) when the finding was first detected. |
-
is_in_security_inbox |
- boolean | -Path: @is_in_security_inboxtrue if the finding appears in the Security Inbox; false otherwise. |
-
last_detected_at |
- integer | -Path: @last_detected_atDiscovery timestamp in milliseconds (UTC) when the last detection was received by the finding platform. |
-
last_seen_at |
- integer | -Path: @last_seen_atTimestamp in milliseconds (UTC) when the finding was most recently detected. |
-
origin |
- array (string) | -Path: @originDetection origins that produced the finding, such as agentless scans, APM, SCA (Software Composition Analysis), or CI (Continuous Integration). |
-
related_services |
- array (string) | -Path: @related_servicesServices that are inferred from Source Code Integration (for example, for SAST findings). |
-
resource_id |
- string | -Path: @resource_idUnique identifier of the resource affected by the finding. |
-
resource_name |
- string | -Path: @resource_nameHuman-readable name of the resource affected by the finding. |
-
resource_type |
- string | -Path: @resource_typeType of the resource. |
-
severity |
- string | -Path: @severityFinal severity level of the finding, after Datadog adjustments and any user-defined severity modifications. Valid values: critical, high, medium, low, info, none, unknown. |
-
source_finding_raw_data |
- object | -Path: @source_finding_raw_dataRaw data from third-party integrations that generated the finding. |
-
status |
- string | -Path: @statusWorkflow status of the finding. Valid values: open, muted, auto_closed, resolved, in-progress. |
-
time_to_resolution |
- integer | -Path: @time_to_resolutionTime in seconds between when the finding was first detected and when it was resolved. |
-
title |
- string | -Path: @titleHuman-readable title for the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
category |
- string | -Path: @additional_resources.categoryCategory of the additional resource. Valid values: cloud_resource, k8s, host, service, git, iac_resource. |
-
configuration |
- object | -Path: @additional_resources.configurationConfiguration of the additional resource. |
-
key |
- string | -Path: @additional_resources.keyCanonical Cloud Resource Identifier (CCRID) of the additional resource when the resource is cloud-backed (for example, when category is cloud_resource). This field may be omitted for non-cloud categories such as k8s, host, service, or git. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
aliases |
- array (string) | -Path: @advisory.aliasesAdditional identifiers referring to the same vulnerability, created by other entities. |
-
cve |
- string | -Path: @advisory.cvePrimary globally recognized identifier for a security vulnerability, following the CVE-YYYY-NNNN format. |
-
first_remediation_available_at |
- integer | -Path: @advisory.first_remediation_available_atTimestamp in milliseconds (UTC) when the first remediation for the advisory became available. |
-
id |
- string | -Path: @advisory.idInternal identifier for the advisory. |
-
modified_at |
- integer | -Path: @advisory.modified_atTimestamp in milliseconds (UTC) when the advisory was last updated. |
-
published_at |
- integer | -Path: @advisory.published_atTimestamp in milliseconds (UTC) when the advisory was published. |
-
summary |
- string | -Path: @advisory.summaryShort summary of the advisory. |
-
type |
- string | -Path: @advisory.typeType of the advisory. Valid values: component_with_known_vulnerability, unmaintained, end_of_life, dangerous_workflows, risky_license, malicious_package. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
method |
- string | -Path: @api_endpoint.methodMethod of the endpoint (HTTP verb or gRPC method). |
-
operation_name |
- string | -Path: @api_endpoint.operation_nameName of the entry point into a service (for example, http.request, grpc.server). |
-
path |
- string | -Path: @api_endpoint.pathRelative templated path of the endpoint. |
-
request_path |
- string | -Path: @api_endpoint.request_pathRelative path of the endpoint. |
-
resource_name |
- string | -Path: @api_endpoint.resource_nameInternal identification of the endpoint in the format <method> <path>. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
account |
- string | -Path: @cloud_resource.accountCloud account that owns the cloud resource (for example, AWS account, Azure subscription, GCP project, OCI tenancy). |
-
account_name |
- string | -Path: @cloud_resource.account_nameHuman-readable name of the cloud account owning the resource. |
-
category |
- string | -Path: @cloud_resource.categoryCategory the resource type belongs to. |
-
cloud_provider |
- string | -Path: @cloud_resource.cloud_providerCloud provider hosting the resource. Valid values: aws, azure, gcp, oci. |
-
cloud_provider_url |
- string | -Path: @cloud_resource.cloud_provider_urlLink to the resource in the cloud provider console. |
-
configuration |
- object | -Path: @cloud_resource.configurationConfiguration of the cloud resource, as returned by the cloud provider. |
-
context |
- object | -Path: @cloud_resource.contextContext for the cloud resource. |
-
display_name |
- string | -Path: @cloud_resource.display_nameDisplay name of the resource. |
-
key |
- string | -Path: @cloud_resource.keyCanonical Cloud Resource Identifier (CCRID). |
-
public_accessibility_paths |
- array (string) | -Path: @cloud_resource.public_accessibility_pathsNetwork paths through which the resource is accessible from the public internet. |
-
public_port_ranges |
- array (object) | -Path: @cloud_resource.public_port_rangesPort ranges on the resource that are exposed to the public internet. |
-
region |
- string | -Path: @cloud_resource.regionCloud region where the resource is located. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
from_port |
- integer | -Path: @cloud_resource.public_port_ranges.from_portStarting port number of the exposed range. |
-
to_port |
- integer | -Path: @cloud_resource.public_port_ranges.to_portEnding port number of the exposed range. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
column_end |
- integer | -Path: @code_location.column_endEnding column position. |
-
column_start |
- integer | -Path: @code_location.column_startStarting column position. |
-
filename |
- string | -Path: @code_location.filenameRelative path to the file. |
-
is_test_file |
- boolean | -Path: @code_location.is_test_filetrue if the code file is a test file; false otherwise. |
-
line_end |
- integer | -Path: @code_location.line_endEnding line number. |
-
line_start |
- integer | -Path: @code_location.line_startStarting line number. |
-
symbol |
- string | -Path: @code_location.symbolSymbol name at the code location. |
-
url |
- string | -Path: @code_location.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
agent |
- object | -Path: @compliance.agentMetadata about the compliance agent that produced the finding. |
-
evaluation |
- string | -Path: @compliance.evaluationCompliance evaluation result. Valid values: pass (resource is properly configured), fail (resource is misconfigured). |
-
frameworks |
- array (object) | -Path: @compliance.frameworksCompliance frameworks mapped to the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
agent_framework_id |
- string | -Path: @compliance.agent.agent_framework_idIdentifier of the compliance framework used by the agent. |
-
agent_rule_id |
- string | -Path: @compliance.agent.agent_rule_idIdentifier of the agent rule that triggered the finding. |
-
agent_version |
- string | -Path: @compliance.agent.agent_versionVersion of the compliance agent that produced the finding. |
-
data |
- object | -Path: @compliance.agent.dataAdditional data produced by the compliance agent evaluation. |
-
evaluator |
- string | -Path: @compliance.agent.evaluatorName of the evaluator that assessed the compliance finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
control |
- string | -Path: @compliance.frameworks.controlIdentifier of the control within the compliance framework. |
-
framework |
- string | -Path: @compliance.frameworks.frameworkIdentifier of the compliance framework (e.g., cis, pci-dss). |
-
is_default |
- boolean | -Path: @compliance.frameworks.is_defaulttrue if this is the default framework mapping for the finding, false otherwise. |
-
requirement |
- string | -Path: @compliance.frameworks.requirementIdentifier of the requirement within the control. |
-
version |
- string | -Path: @compliance.frameworks.versionVersion of the compliance framework. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
architectures |
- array (string) | -Path: @container_image.architecturesArchitectures associated with the container image. |
-
base_image |
- object | -Path: @container_image.base_imageBase image this container image is built on. A base image is itself a container image and may have its own base_image. Absent when no base image is identified. |
-
git_repository_url |
- string | -Path: @container_image.git_repository_urlURL of the Git repository for the code used to build the container image. Available only when Source Code Integration is configured. |
-
image_layer_diff_ids |
- array (string) | -Path: @container_image.image_layer_diff_idsDiff IDs of the image layers, in the order they were applied. Each diff ID is the SHA256 of the uncompressed layer contents. |
-
image_layer_digests |
- array (string) | -Path: @container_image.image_layer_digestsDigests of the image layers, in the order they were applied. Each digest is the SHA256 of the compressed layer blob. |
-
name |
- string | -Path: @container_image.nameFull name of the container image. |
-
oses |
- array (object) | -Path: @container_image.osesOperating systems associated with the container image. |
-
registries |
- array (string) | -Path: @container_image.registriesContainer registry where the image is stored or was pulled from. |
-
repo_digests |
- array (string) | -Path: @container_image.repo_digestsRepository digests of the container image where the finding was detected. |
-
repository |
- string | -Path: @container_image.repositoryRepository of the container image. |
-
tags |
- array (string) | -Path: @container_image.tagsTag part of the container image name (for example, latest or 1.2.3). |
-
versions |
- array (string) | -Path: @container_image.versionsVersions of the container image where the finding was detected. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
name |
- string | -Path: @container_image.oses.nameOperating system name. |
-
version |
- string | -Path: @container_image.oses.versionOperating system version. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
name |
- string | -Path: @detection_tool.nameName of the detection tool or engine that generated the finding. |
-
version |
- string | -Path: @detection_tool.versionVersion of the detection tool or engine that generated the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
author |
- object | -Path: @git.authorContains details about the original author of the commit, including name, email, and authoring timestamp. Remains unchanged when the commit is rebased, cherry-picked, or re-applied. |
-
branch |
- string | -Path: @git.branchName of the Git branch related to the finding. |
-
codeowners |
- array (string) | -Path: @git.codeownersCode owner teams extracted from the SCM (Source Control Management) provider's CODEOWNERS file on platforms like GitHub. |
-
committer |
- object | -Path: @git.committerContains details about the person who last applied the commit to the repository, including name, email, and commit timestamp. May differ from the author when the commit is rebased, amended, or applied with git am. |
-
default_branch |
- string | -Path: @git.default_branchDefault branch defined for the Git repository. |
-
is_default_branch |
- boolean | -Path: @git.is_default_branchtrue if the current branch is the default branch for the repository; false otherwise. |
-
repository_id |
- string | -Path: @git.repository_idNormalized identifier of the Git repository. |
-
repository_url |
- string | -Path: @git.repository_urlGit repository URL related to the finding. |
-
repository_visibility |
- string | -Path: @git.repository_visibilityVisibility of the repository. Valid values: public, private, not_detected. |
-
sha |
- string | -Path: @git.shaGit commit identifier (SHA). |
-
| Attribute name | -Type | -Description | -
|---|---|---|
authored_at |
- integer | -Path: @git.author.authored_atTimestamp in milliseconds (UTC) when the original changes were made. |
-
email |
- string | -Path: @git.author.emailEmail address of the commit author. |
-
name |
- string | -Path: @git.author.nameName of the commit author. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
committed_at |
- integer | -Path: @git.committer.committed_atTimestamp in milliseconds (UTC) when the changes were last significantly modified (for example, during a rebase or amend operation). |
-
email |
- string | -Path: @git.committer.emailEmail address of the committer. |
-
name |
- string | -Path: @git.committer.nameName of the committer. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
architectures |
- array (string) | -Path: @host.architecturesArchitectures associated with the host. |
-
cloud_provider |
- string | -Path: @host.cloud_providerCloud provider the host belongs to. |
-
image |
- string | -Path: @host.imageName of the host image used to build the host (for example, ami-1234). |
-
key |
- string | -Path: @host.keyCanonical Cloud Resource Identifier (CCRID). |
-
name |
- string | -Path: @host.nameHost name. |
-
os |
- object | -Path: @host.osAttributes of the operating system running on the host. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
name |
- string | -Path: @host.os.nameOperating system name. |
-
version |
- string | -Path: @host.os.versionOperating system version. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
platform |
- string | -Path: @iac_resource.platformIaC (Infrastructure as Code) platform the vulnerability was found on (for example, terraform, kubernetes). |
-
provider |
- string | -Path: @iac_resource.providerIaC (Infrastructure as Code) provider where the resource is defined (for example, aws, gcp, azure). |
-
| Attribute name | -Type | -Description | -
|---|---|---|
cluster_id |
- string | -Path: @k8s.cluster_idKubernetes cluster identifier. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
schema_version |
- string | -Path: @metadata.schema_versionIndicates the findings schema version used for the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
additional_names |
- array (string) | -Path: @package.additional_namesAdditional affected package names, if the cloud vulnerability impacted multiple packages derived from the same source package. |
-
declaration |
- object | -Path: @package.declarationCode locations of the package definition. |
-
dependency_location_text |
- string | -Path: @package.dependency_location_textText representation of the dependency location, such as the file path where the vulnerable package is declared. |
-
dependency_type |
- string | -Path: @package.dependency_typeWhether the package is a direct dependency, transitive dependency, or not supported if the information cannot be retrieved. |
-
has_suid |
- boolean | -Path: @package.has_suidtrue if the package has the SUID bit set; false otherwise. |
-
is_running |
- boolean | -Path: @package.is_runningtrue if the package is currently running; false otherwise. |
-
is_running_as_root |
- boolean | -Path: @package.is_running_as_roottrue if the package is currently running as root; false otherwise. |
-
loading_type |
- string | -Path: @package.loading_typeWhether the component is always loaded and running ( hot), running infrequently (cold), or loaded on demand (lazy). |
-
manager |
- string | -Path: @package.managerPackage management ecosystem or source registry the vulnerable component originates from. |
-
name |
- string | -Path: @package.nameName of the package or library where the vulnerability was identified. |
-
normalized_name |
- string | -Path: @package.normalized_nameNormalized name according to the ecosystem of the package or library where the vulnerability was identified. |
-
root_parents |
- array (object) | -Path: @package.root_parentsList of dependencies for which the package is a transitive dependency. |
-
scope |
- string | -Path: @package.scopeIntended usage scope of the package ( production or development). |
-
version |
- string | -Path: @package.versionVersion of the package or library where the vulnerability was identified. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
block |
- object | -Path: @package.declaration.blockLocation of the code that declares the whole dependency declaration. |
-
name |
- object | -Path: @package.declaration.nameLocation of the code that declares the dependency name. |
-
version |
- object | -Path: @package.declaration.versionVersion declared for the root parent. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
column_end |
- integer | -Path: @package.declaration.block.column_endEnding column position. |
-
column_start |
- integer | -Path: @package.declaration.block.column_startStarting column position. |
-
filename |
- string | -Path: @package.declaration.block.filenameRelative path to the file. |
-
is_test_file |
- boolean | -Path: @package.declaration.block.is_test_filetrue if the code file is a test file; false otherwise. |
-
line_end |
- integer | -Path: @package.declaration.block.line_endEnding line number. |
-
line_start |
- integer | -Path: @package.declaration.block.line_startStarting line number. |
-
symbol |
- string | -Path: @package.declaration.block.symbolSymbol name at the code location. |
-
url |
- string | -Path: @package.declaration.block.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
column_end |
- integer | -Path: @package.declaration.name.column_endEnding column position. |
-
column_start |
- integer | -Path: @package.declaration.name.column_startStarting column position. |
-
filename |
- string | -Path: @package.declaration.name.filenameRelative path to the file. |
-
is_test_file |
- boolean | -Path: @package.declaration.name.is_test_filetrue if the code file is a test file; false otherwise. |
-
line_end |
- integer | -Path: @package.declaration.name.line_endEnding line number. |
-
line_start |
- integer | -Path: @package.declaration.name.line_startStarting line number. |
-
symbol |
- string | -Path: @package.declaration.name.symbolSymbol name at the code location. |
-
url |
- string | -Path: @package.declaration.name.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
column_end |
- integer | -Path: @package.declaration.version.column_endEnding column position. |
-
column_start |
- integer | -Path: @package.declaration.version.column_startStarting column position. |
-
filename |
- string | -Path: @package.declaration.version.filenameRelative path to the file. |
-
is_test_file |
- boolean | -Path: @package.declaration.version.is_test_filetrue if the code file is a test file; false otherwise. |
-
line_end |
- integer | -Path: @package.declaration.version.line_endEnding line number. |
-
line_start |
- integer | -Path: @package.declaration.version.line_startStarting line number. |
-
symbol |
- string | -Path: @package.declaration.version.symbolSymbol name at the code location. |
-
url |
- string | -Path: @package.declaration.version.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
declaration |
- object | -Path: @package.root_parents.declarationLocation of the code that declares the version of a root parent. |
-
language |
- string | -Path: @package.root_parents.languageDependency language for which the package is a transitive dependency. |
-
name |
- string | -Path: @package.root_parents.nameDependency name for which the package is a transitive dependency. |
-
version |
- string | -Path: @package.root_parents.versionDependency version for which the package is a transitive dependency. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
block |
- object | -Path: @package.root_parents.declaration.blockLocation of the code that declares the whole dependency declaration. |
-
name |
- object | -Path: @package.root_parents.declaration.nameLocation of the code that declares the dependency name. |
-
version |
- object | -Path: @package.root_parents.declaration.versionVersion declared for the root parent. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
column_end |
- integer | -Path: @package.root_parents.declaration.block.column_endEnding column position. |
-
column_start |
- integer | -Path: @package.root_parents.declaration.block.column_startStarting column position. |
-
filename |
- string | -Path: @package.root_parents.declaration.block.filenameRelative path to the file. |
-
is_test_file |
- boolean | -Path: @package.root_parents.declaration.block.is_test_filetrue if the code file is a test file; false otherwise. |
-
line_end |
- integer | -Path: @package.root_parents.declaration.block.line_endEnding line number. |
-
line_start |
- integer | -Path: @package.root_parents.declaration.block.line_startStarting line number. |
-
symbol |
- string | -Path: @package.root_parents.declaration.block.symbolSymbol name at the code location. |
-
url |
- string | -Path: @package.root_parents.declaration.block.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
column_end |
- integer | -Path: @package.root_parents.declaration.name.column_endEnding column position. |
-
column_start |
- integer | -Path: @package.root_parents.declaration.name.column_startStarting column position. |
-
filename |
- string | -Path: @package.root_parents.declaration.name.filenameRelative path to the file. |
-
is_test_file |
- boolean | -Path: @package.root_parents.declaration.name.is_test_filetrue if the code file is a test file; false otherwise. |
-
line_end |
- integer | -Path: @package.root_parents.declaration.name.line_endEnding line number. |
-
line_start |
- integer | -Path: @package.root_parents.declaration.name.line_startStarting line number. |
-
symbol |
- string | -Path: @package.root_parents.declaration.name.symbolSymbol name at the code location. |
-
url |
- string | -Path: @package.root_parents.declaration.name.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
column_end |
- integer | -Path: @package.root_parents.declaration.version.column_endEnding column position. |
-
column_start |
- integer | -Path: @package.root_parents.declaration.version.column_startStarting column position. |
-
filename |
- string | -Path: @package.root_parents.declaration.version.filenameRelative path to the file. |
-
is_test_file |
- boolean | -Path: @package.root_parents.declaration.version.is_test_filetrue if the code file is a test file; false otherwise. |
-
line_end |
- integer | -Path: @package.root_parents.declaration.version.line_endEnding line number. |
-
line_start |
- integer | -Path: @package.root_parents.declaration.version.line_startStarting line number. |
-
symbol |
- string | -Path: @package.root_parents.declaration.version.symbolSymbol name at the code location. |
-
url |
- string | -Path: @package.root_parents.declaration.version.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
code_update |
- object | -Path: @remediation.code_updateCode changes to apply to remediate the finding. |
-
codegen |
- object | -Path: @remediation.codegenFinding status for the code generation platform. |
-
container_image |
- object | -Path: @remediation.container_imageNewer container image version that may remediate the vulnerability. |
-
description |
- string | -Path: @remediation.descriptionDescription of the remediation. |
-
host_image |
- object | -Path: @remediation.host_imageLatest host image version that may remediate the vulnerability. |
-
is_available |
- boolean | -Path: @remediation.is_availabletrue if a remediation is currently available for the finding; false otherwise. |
-
microsoft_kb |
- object | -Path: @remediation.microsoft_kbRemediation strategy using a Microsoft Knowledge Base (KB) article. |
-
package |
- object | -Path: @remediation.packageRemediation package information. |
-
recommended |
- object | -Path: @remediation.recommendedRecommended remediation details. |
-
recommended_type |
- string | -Path: @remediation.recommended_typeRecommended remediation type for the finding. |
-
root_package |
- object | -Path: @remediation.root_packageRemediation root package information. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
edits |
- array (object) | -Path: @remediation.code_update.editsCode changes required to remediate the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
column_end |
- integer | -Path: @remediation.code_update.edits.column_endEnding column position of the code change. |
-
column_start |
- integer | -Path: @remediation.code_update.edits.column_startStarting column position of the code change. |
-
content |
- string | -Path: @remediation.code_update.edits.contentContents of the code change. |
-
line_end |
- integer | -Path: @remediation.code_update.edits.line_endEnding line number of the code change. |
-
line_start |
- integer | -Path: @remediation.code_update.edits.line_startStarting line number of the code change. |
-
type |
- string | -Path: @remediation.code_update.edits.typeNature of the code change. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
id |
- string | -Path: @remediation.codegen.idIdentifier used to track the remediation in the code generation backend. |
-
status |
- string | -Path: @remediation.codegen.statusStatus of the automated fix generation. Valid values: generated, not_available_non_default_branch, not_available_unsupported_tool, not_available_unsupported_rule, not_available_disabled, not_available_git_provider_not_supported, not_available_confidence_too_low, error, not_available_has_deterministic_fixes, not_available_unknown_reason, not_available_org_not_onboarded, not_available_repository_disabled, not_available_unsupported_resource_type, not_available_unsupported_ecosystem, not_available_severity_too_low, not_available_transitive_library, not_available_no_remediation, not_available_unsupported_vulnerability_type. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
closest_no_vulnerabilities |
- object | -Path: @remediation.container_image.closest_no_vulnerabilitiesClosest container image version with no vulnerabilities. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
image_url |
- string | -Path: @remediation.container_image.closest_no_vulnerabilities.image_urlURL of the container image that may remediate the vulnerability. |
-
layer_digests |
- array (string) | -Path: @remediation.container_image.closest_no_vulnerabilities.layer_digestsLayer digests of the currently vulnerable container image that needs to be upgraded. |
-
name |
- string | -Path: @remediation.container_image.closest_no_vulnerabilities.nameName of the container image that may remediate the vulnerability. |
-
tag |
- string | -Path: @remediation.container_image.closest_no_vulnerabilities.tagTag of the container image that may remediate the vulnerability. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
latest_major |
- object | -Path: @remediation.host_image.latest_majorInformation about the latest Amazon Machine Image (AMI) that may remediate the vulnerability. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
name |
- string | -Path: @remediation.host_image.latest_major.nameName of the latest Amazon Machine Image (for example, ami-12345678) that may remediate the vulnerability. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
closest_fix_advisory |
- object | -Path: @remediation.microsoft_kb.closest_fix_advisoryThe closest patch available to address the current advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
article |
- string | -Path: @remediation.microsoft_kb.closest_fix_advisory.articleArticle name for the closest patch. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base |
- array (object) | -Path: @remediation.package.baseCurrent package version that the finding was detected on, before any remediation is applied. |
-
closest_no_critical |
- array (object) | -Path: @remediation.package.closest_no_criticalClosest package version with no critical vulnerabilities (based on base score). |
-
closest_no_vulnerabilities |
- array (object) | -Path: @remediation.package.closest_no_vulnerabilitiesClosest package version with no vulnerabilities. |
-
latest_no_critical |
- array (object) | -Path: @remediation.package.latest_no_criticalThe latest remediation package version with no critical vulnerabilities (based on base score). |
-
latest_no_vulnerabilities |
- array (object) | -Path: @remediation.package.latest_no_vulnerabilitiesLatest package version with no vulnerabilities. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
fixed_advisories |
- array (object) | -Path: @remediation.package.base.fixed_advisoriesAdvisories that the remediation will fix. |
-
has_incomplete_data |
- boolean | -Path: @remediation.package.base.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
-
is_auto_solvable |
- boolean | -Path: @remediation.package.base.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
-
name |
- string | -Path: @remediation.package.base.nameRecommended package name that fixes the finding. |
-
new_advisories |
- array (object) | -Path: @remediation.package.base.new_advisoriesAdvisories that will appear if the remediation is applied. |
-
original_name |
- string | -Path: @remediation.package.base.original_nameOriginal name of the recommended package that fixes the finding. |
-
remaining_advisories |
- array (object) | -Path: @remediation.package.base.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
-
version |
- string | -Path: @remediation.package.base.versionRecommended package version that fixes the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.base.fixed_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.base.fixed_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.base.new_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.base.new_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.base.remaining_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.base.remaining_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
fixed_advisories |
- array (object) | -Path: @remediation.package.closest_no_critical.fixed_advisoriesAdvisories that the remediation will fix. |
-
has_incomplete_data |
- boolean | -Path: @remediation.package.closest_no_critical.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
-
is_auto_solvable |
- boolean | -Path: @remediation.package.closest_no_critical.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
-
name |
- string | -Path: @remediation.package.closest_no_critical.nameRecommended package name that fixes the finding. |
-
new_advisories |
- array (object) | -Path: @remediation.package.closest_no_critical.new_advisoriesAdvisories that will appear if the remediation is applied. |
-
original_name |
- string | -Path: @remediation.package.closest_no_critical.original_nameOriginal name of the recommended package that fixes the finding. |
-
remaining_advisories |
- array (object) | -Path: @remediation.package.closest_no_critical.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
-
version |
- string | -Path: @remediation.package.closest_no_critical.versionRecommended package version that fixes the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.closest_no_critical.fixed_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.closest_no_critical.fixed_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.closest_no_critical.new_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.closest_no_critical.new_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.closest_no_critical.remaining_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.closest_no_critical.remaining_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
fixed_advisories |
- array (object) | -Path: @remediation.package.closest_no_vulnerabilities.fixed_advisoriesAdvisories that the remediation will fix. |
-
has_incomplete_data |
- boolean | -Path: @remediation.package.closest_no_vulnerabilities.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
-
is_auto_solvable |
- boolean | -Path: @remediation.package.closest_no_vulnerabilities.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
-
name |
- string | -Path: @remediation.package.closest_no_vulnerabilities.nameRecommended package name that fixes the finding. |
-
new_advisories |
- array (object) | -Path: @remediation.package.closest_no_vulnerabilities.new_advisoriesAdvisories that will appear if the remediation is applied. |
-
original_name |
- string | -Path: @remediation.package.closest_no_vulnerabilities.original_nameOriginal name of the recommended package that fixes the finding. |
-
remaining_advisories |
- array (object) | -Path: @remediation.package.closest_no_vulnerabilities.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
-
version |
- string | -Path: @remediation.package.closest_no_vulnerabilities.versionRecommended package version that fixes the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.closest_no_vulnerabilities.fixed_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.closest_no_vulnerabilities.fixed_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.closest_no_vulnerabilities.new_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.closest_no_vulnerabilities.new_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.closest_no_vulnerabilities.remaining_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.closest_no_vulnerabilities.remaining_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
fixed_advisories |
- array (object) | -Path: @remediation.package.latest_no_critical.fixed_advisoriesAdvisories that the remediation will fix. |
-
has_incomplete_data |
- boolean | -Path: @remediation.package.latest_no_critical.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
-
is_auto_solvable |
- boolean | -Path: @remediation.package.latest_no_critical.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
-
name |
- string | -Path: @remediation.package.latest_no_critical.nameRecommended package name that fixes the finding. |
-
new_advisories |
- array (object) | -Path: @remediation.package.latest_no_critical.new_advisoriesAdvisories that will appear if the remediation is applied. |
-
original_name |
- string | -Path: @remediation.package.latest_no_critical.original_nameOriginal name of the recommended package that fixes the finding. |
-
remaining_advisories |
- array (object) | -Path: @remediation.package.latest_no_critical.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
-
version |
- string | -Path: @remediation.package.latest_no_critical.versionRecommended package version that fixes the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.latest_no_critical.fixed_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.latest_no_critical.fixed_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.latest_no_critical.new_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.latest_no_critical.new_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.latest_no_critical.remaining_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.latest_no_critical.remaining_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
fixed_advisories |
- array (object) | -Path: @remediation.package.latest_no_vulnerabilities.fixed_advisoriesAdvisories that the remediation will fix. |
-
has_incomplete_data |
- boolean | -Path: @remediation.package.latest_no_vulnerabilities.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
-
is_auto_solvable |
- boolean | -Path: @remediation.package.latest_no_vulnerabilities.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
-
name |
- string | -Path: @remediation.package.latest_no_vulnerabilities.nameRecommended package name that fixes the finding. |
-
new_advisories |
- array (object) | -Path: @remediation.package.latest_no_vulnerabilities.new_advisoriesAdvisories that will appear if the remediation is applied. |
-
original_name |
- string | -Path: @remediation.package.latest_no_vulnerabilities.original_nameOriginal name of the recommended package that fixes the finding. |
-
remaining_advisories |
- array (object) | -Path: @remediation.package.latest_no_vulnerabilities.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
-
version |
- string | -Path: @remediation.package.latest_no_vulnerabilities.versionRecommended package version that fixes the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.latest_no_vulnerabilities.fixed_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.latest_no_vulnerabilities.fixed_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.latest_no_vulnerabilities.new_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.latest_no_vulnerabilities.new_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.package.latest_no_vulnerabilities.remaining_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.package.latest_no_vulnerabilities.remaining_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base |
- array (object) | -Path: @remediation.root_package.baseCurrent package version that the finding was detected on, before any remediation is applied. |
-
closest_no_critical |
- array (object) | -Path: @remediation.root_package.closest_no_criticalClosest package version with no critical vulnerabilities (based on base score). |
-
closest_no_vulnerabilities |
- array (object) | -Path: @remediation.root_package.closest_no_vulnerabilitiesClosest package version with no vulnerabilities. |
-
latest_no_critical |
- array (object) | -Path: @remediation.root_package.latest_no_criticalThe latest remediation package version with no critical vulnerabilities (based on base score). |
-
latest_no_vulnerabilities |
- array (object) | -Path: @remediation.root_package.latest_no_vulnerabilitiesLatest package version with no vulnerabilities. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
fixed_advisories |
- array (object) | -Path: @remediation.root_package.base.fixed_advisoriesAdvisories that the remediation will fix. |
-
has_incomplete_data |
- boolean | -Path: @remediation.root_package.base.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
-
is_auto_solvable |
- boolean | -Path: @remediation.root_package.base.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
-
name |
- string | -Path: @remediation.root_package.base.nameRecommended package name that fixes the finding. |
-
new_advisories |
- array (object) | -Path: @remediation.root_package.base.new_advisoriesAdvisories that will appear if the remediation is applied. |
-
original_name |
- string | -Path: @remediation.root_package.base.original_nameOriginal name of the recommended package that fixes the finding. |
-
remaining_advisories |
- array (object) | -Path: @remediation.root_package.base.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
-
version |
- string | -Path: @remediation.root_package.base.versionRecommended package version that fixes the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.base.fixed_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.base.fixed_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.base.new_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.base.new_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.base.remaining_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.base.remaining_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
fixed_advisories |
- array (object) | -Path: @remediation.root_package.closest_no_critical.fixed_advisoriesAdvisories that the remediation will fix. |
-
has_incomplete_data |
- boolean | -Path: @remediation.root_package.closest_no_critical.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
-
is_auto_solvable |
- boolean | -Path: @remediation.root_package.closest_no_critical.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
-
name |
- string | -Path: @remediation.root_package.closest_no_critical.nameRecommended package name that fixes the finding. |
-
new_advisories |
- array (object) | -Path: @remediation.root_package.closest_no_critical.new_advisoriesAdvisories that will appear if the remediation is applied. |
-
original_name |
- string | -Path: @remediation.root_package.closest_no_critical.original_nameOriginal name of the recommended package that fixes the finding. |
-
remaining_advisories |
- array (object) | -Path: @remediation.root_package.closest_no_critical.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
-
version |
- string | -Path: @remediation.root_package.closest_no_critical.versionRecommended package version that fixes the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.closest_no_critical.fixed_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.closest_no_critical.fixed_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.closest_no_critical.new_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.closest_no_critical.new_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.closest_no_critical.remaining_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.closest_no_critical.remaining_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
fixed_advisories |
- array (object) | -Path: @remediation.root_package.closest_no_vulnerabilities.fixed_advisoriesAdvisories that the remediation will fix. |
-
has_incomplete_data |
- boolean | -Path: @remediation.root_package.closest_no_vulnerabilities.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
-
is_auto_solvable |
- boolean | -Path: @remediation.root_package.closest_no_vulnerabilities.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
-
name |
- string | -Path: @remediation.root_package.closest_no_vulnerabilities.nameRecommended package name that fixes the finding. |
-
new_advisories |
- array (object) | -Path: @remediation.root_package.closest_no_vulnerabilities.new_advisoriesAdvisories that will appear if the remediation is applied. |
-
original_name |
- string | -Path: @remediation.root_package.closest_no_vulnerabilities.original_nameOriginal name of the recommended package that fixes the finding. |
-
remaining_advisories |
- array (object) | -Path: @remediation.root_package.closest_no_vulnerabilities.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
-
version |
- string | -Path: @remediation.root_package.closest_no_vulnerabilities.versionRecommended package version that fixes the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.closest_no_vulnerabilities.fixed_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.closest_no_vulnerabilities.fixed_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.closest_no_vulnerabilities.new_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.closest_no_vulnerabilities.new_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.closest_no_vulnerabilities.remaining_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.closest_no_vulnerabilities.remaining_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
fixed_advisories |
- array (object) | -Path: @remediation.root_package.latest_no_critical.fixed_advisoriesAdvisories that the remediation will fix. |
-
has_incomplete_data |
- boolean | -Path: @remediation.root_package.latest_no_critical.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
-
is_auto_solvable |
- boolean | -Path: @remediation.root_package.latest_no_critical.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
-
name |
- string | -Path: @remediation.root_package.latest_no_critical.nameRecommended package name that fixes the finding. |
-
new_advisories |
- array (object) | -Path: @remediation.root_package.latest_no_critical.new_advisoriesAdvisories that will appear if the remediation is applied. |
-
original_name |
- string | -Path: @remediation.root_package.latest_no_critical.original_nameOriginal name of the recommended package that fixes the finding. |
-
remaining_advisories |
- array (object) | -Path: @remediation.root_package.latest_no_critical.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
-
version |
- string | -Path: @remediation.root_package.latest_no_critical.versionRecommended package version that fixes the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.latest_no_critical.fixed_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.latest_no_critical.fixed_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.latest_no_critical.new_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.latest_no_critical.new_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.latest_no_critical.remaining_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.latest_no_critical.remaining_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
fixed_advisories |
- array (object) | -Path: @remediation.root_package.latest_no_vulnerabilities.fixed_advisoriesAdvisories that the remediation will fix. |
-
has_incomplete_data |
- boolean | -Path: @remediation.root_package.latest_no_vulnerabilities.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
-
is_auto_solvable |
- boolean | -Path: @remediation.root_package.latest_no_vulnerabilities.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
-
name |
- string | -Path: @remediation.root_package.latest_no_vulnerabilities.nameRecommended package name that fixes the finding. |
-
new_advisories |
- array (object) | -Path: @remediation.root_package.latest_no_vulnerabilities.new_advisoriesAdvisories that will appear if the remediation is applied. |
-
original_name |
- string | -Path: @remediation.root_package.latest_no_vulnerabilities.original_nameOriginal name of the recommended package that fixes the finding. |
-
remaining_advisories |
- array (object) | -Path: @remediation.root_package.latest_no_vulnerabilities.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
-
version |
- string | -Path: @remediation.root_package.latest_no_vulnerabilities.versionRecommended package version that fixes the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.latest_no_vulnerabilities.fixed_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.latest_no_vulnerabilities.fixed_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.latest_no_vulnerabilities.new_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.latest_no_vulnerabilities.new_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
base_severity |
- string | -Path: @remediation.root_package.latest_no_vulnerabilities.remaining_advisories.base_severityBase severity of the advisory. |
-
id |
- string | -Path: @remediation.root_package.latest_no_vulnerabilities.remaining_advisories.idIdentifier of the advisory. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
has_exploit_available |
- boolean | -Path: @risk.has_exploit_availabletrue if known exploits exist for the finding; false otherwise. |
-
has_high_exploitability_chance |
- boolean | -Path: @risk.has_high_exploitability_chancetrue if the EPSS (Exploit Prediction Scoring System) score is above 1%; false otherwise. |
-
has_privileged_access |
- boolean | -Path: @risk.has_privileged_accesstrue if the finding's resource is running with elevated privileges or has the ability to assume a privileged role; false otherwise. |
-
has_sensitive_data |
- boolean | -Path: @risk.has_sensitive_datatrue if the finding has access to a resource that contains sensitive data; false otherwise. |
-
is_authenticated |
- boolean | -Path: @risk.is_authenticatedtrue if the API endpoint requires authentication to access; false if the endpoint does not require authentication. Omitted if authentication status is unknown. |
-
is_crown_jewel |
- boolean | -Path: @risk.is_crown_jeweltrue if the affected resource is critical to your business; false otherwise. |
-
is_emerging |
- boolean | -Path: @risk.is_emergingtrue if the vulnerability is linked to an advisory classified as an emerging vulnerability; false otherwise. |
-
is_exposed_to_attacks |
- boolean | -Path: @risk.is_exposed_to_attackstrue if attacks have already been detected on the resource; false otherwise. |
-
is_function_reachable |
- boolean | -Path: @risk.is_function_reachabletrue if the vulnerable function can be executed; false otherwise. |
-
is_image_running |
- boolean | -Path: @risk.is_image_runningtrue if the image of the finding's resource has running containers or hosts; false otherwise. |
-
is_kernel_running |
- boolean | -Path: @risk.is_kernel_runningtrue if the vulnerability affects the kernel currently running on the host; false otherwise. |
-
is_package_running |
- boolean | -Path: @risk.is_package_runningtrue if the package of the finding's resource is running; false otherwise. |
-
is_production |
- boolean | -Path: @risk.is_productiontrue if the finding's resource is running in production; false otherwise. |
-
is_publicly_accessible |
- boolean | -Path: @risk.is_publicly_accessibletrue if the finding's resource is publicly accessible; false otherwise. |
-
is_tainted_from_database |
- boolean | -Path: @risk.is_tainted_from_databasetrue if the string is tainted due to originating from an untrusted database source; false otherwise. |
-
is_tainted_from_query_string |
- boolean | -Path: @risk.is_tainted_from_query_stringtrue if the string is tainted with elements derived from an HTTP query string; false otherwise. |
-
is_tainted_from_request_url |
- boolean | -Path: @risk.is_tainted_from_request_urltrue if the final URL contains tainted parts originating from the request URL; false otherwise. |
-
is_using_sha1 |
- boolean | -Path: @risk.is_using_sha1true if SHA1 is used in a weak hash; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
has_exploit_available |
- object | -Path: @risk_details.has_exploit_availableInformation about whether a known exploit exists for the finding advisory. |
-
has_high_exploitability_chance |
- object | -Path: @risk_details.has_high_exploitability_chanceEvidence and indicators about whether the vulnerability is likely to be exploited based on EPSS (Exploit Prediction Scoring System). |
-
has_privileged_access |
- object | -Path: @risk_details.has_privileged_accessEvidence and indicators about whether the resource has privileged access. |
-
has_sensitive_data |
- object | -Path: @risk_details.has_sensitive_dataEvidence and indicators about whether the affected resource has sensitive data. |
-
is_authenticated |
- object | -Path: @risk_details.is_authenticatedEvidence and indicators about whether the API endpoint requires authentication. |
-
is_crown_jewel |
- object | -Path: @risk_details.is_crown_jewelEvidence and indicators about whether the affected resource is critical. |
-
is_emerging |
- object | -Path: @risk_details.is_emergingEvidence and indicators about whether the vulnerability is classified as an emerging vulnerability. |
-
is_exposed_to_attacks |
- object | -Path: @risk_details.is_exposed_to_attacksEvidence and indicators about whether the service where the finding was detected is exposed to attacks. |
-
is_function_reachable |
- object | -Path: @risk_details.is_function_reachableEvidence and indicators about whether the vulnerable function or module is used in the code. |
-
is_image_running |
- object | -Path: @risk_details.is_image_runningEvidence and indicators about whether the affected image has running containers or hosts. |
-
is_kernel_running |
- object | -Path: @risk_details.is_kernel_runningEvidence and indicators about whether the vulnerability affects the kernel currently running on the host. |
-
is_package_running |
- object | -Path: @risk_details.is_package_runningEvidence and indicators about whether the affected package is running. |
-
is_production |
- object | -Path: @risk_details.is_productionEvidence and indicators about whether the resource associated with the finding is running in a production environment. |
-
is_publicly_accessible |
- object | -Path: @risk_details.is_publicly_accessibleInformation about whether the affected resource is accessible from the public internet. |
-
is_tainted_from_database |
- object | -Path: @risk_details.is_tainted_from_databaseInformation about whether tainted parts originate from a database. |
-
is_tainted_from_query_string |
- object | -Path: @risk_details.is_tainted_from_query_stringInformation about whether the tainted parts originated from a query string. |
-
is_tainted_from_request_url |
- object | -Path: @risk_details.is_tainted_from_request_urlInformation about whether the tainted parts originate from the request URL. |
-
is_using_sha1 |
- object | -Path: @risk_details.is_using_sha1Information about whether SHA1 is used in a weak hash. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
evidence |
- object | -Path: @risk_details.has_exploit_available.evidenceEvidence of exploit availability. |
-
impact_cvss |
- string | -Path: @risk_details.has_exploit_available.impact_cvssHow the availability of known exploits changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.has_exploit_available.valuetrue if known exploits exist for the finding; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
exploit_sources |
- array (string) | -Path: @risk_details.has_exploit_available.evidence.exploit_sourcesExploit sources associated with the finding (for example, NIST, CISA, Exploit-DB). |
-
exploit_urls |
- array (string) | -Path: @risk_details.has_exploit_available.evidence.exploit_urlsExploit URLs associated with the finding. |
-
type |
- string | -Path: @risk_details.has_exploit_available.evidence.typeType of exploit availability evidence. Valid values: production_ready, poc, unavailable. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
evidence |
- object | -Path: @risk_details.has_high_exploitability_chance.evidenceEvidence for the EPSS score. |
-
impact_cvss |
- string | -Path: @risk_details.has_high_exploitability_chance.impact_cvssHow high exploitability chance affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.has_high_exploitability_chance.valuetrue if the EPSS score is above 1%; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
epss_score |
- number | -Path: @risk_details.has_high_exploitability_chance.evidence.epss_scoreEPSS score as a percentage representing the chance of exploitation. |
-
epss_severity |
- string | -Path: @risk_details.has_high_exploitability_chance.evidence.epss_severityEPSS score severity level. Valid values: Critical, High, Medium, Low. |
-
threshold |
- number | -Path: @risk_details.has_high_exploitability_chance.evidence.thresholdMinimum EPSS score required for a vulnerability to be considered as having a high exploitability chance. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
evidence |
- object | -Path: @risk_details.has_privileged_access.evidenceEvidence showing proof of privileged access. |
-
impact_cvss |
- string | -Path: @risk_details.has_privileged_access.impact_cvssHow privileged access changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.has_privileged_access.valuetrue if the resource associated with the finding has privileged access; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
resource_key |
- string | -Path: @risk_details.has_privileged_access.evidence.resource_keyCanonical Cloud Resource Identifier with proof of privileged access. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
evidence |
- object | -Path: @risk_details.has_sensitive_data.evidenceEvidence supporting the presence of sensitive data. |
-
impact_cvss |
- string | -Path: @risk_details.has_sensitive_data.impact_cvssHow sensitive data presence changes the CVSS score. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.has_sensitive_data.valueSame as risk.has_sensitive_data. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
sds_id |
- string | -Path: @risk_details.has_sensitive_data.evidence.sds_idIdentifier of a sensitive data entry that Datadog Sensitive Data Scanner detected. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
value |
- boolean | -Path: @risk_details.is_authenticated.valueSame as risk.is_authenticated. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
evidence |
- object | -Path: @risk_details.is_crown_jewel.evidenceEvidence used to identify the resource as being critical. |
-
impact_cvss |
- string | -Path: @risk_details.is_crown_jewel.impact_cvssHow resource criticality changes the CVSS score. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_crown_jewel.valuetrue if the resource is critical to your business; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
explanation |
- string | -Path: @risk_details.is_crown_jewel.evidence.explanationExplanation detailing why the resource or related resource is identified as critical. |
-
related_resource_name |
- string | -Path: @risk_details.is_crown_jewel.evidence.related_resource_nameName of a long-lived critical asset, such as a critical service, that justifies why the affected resource is considered critical. |
-
sensitive_data |
- array (string) | -Path: @risk_details.is_crown_jewel.evidence.sensitive_dataSensitive data types detected on the resource that contribute to its classification as a critical asset (for example, visa_credit_card). |
-
| Attribute name | -Type | -Description | -
|---|---|---|
impact_cvss |
- string | -Path: @risk_details.is_emerging.impact_cvssHow emerging vulnerability status affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_emerging.valueSame as risk.is_emerging. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
evidence |
- object | -Path: @risk_details.is_exposed_to_attacks.evidenceEvidence for the presence of attacks. |
-
impact_cvss |
- string | -Path: @risk_details.is_exposed_to_attacks.impact_cvssHow the resource's exposure affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_exposed_to_attacks.valueSame as risk.is_exposed_to_attacks. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
attacks_details |
- object | -Path: @risk_details.is_exposed_to_attacks.evidence.attacks_detailsDetails about one of the detected attacks. |
-
trace_example |
- object | -Path: @risk_details.is_exposed_to_attacks.evidence.trace_exampleExample of a trace with attacks detected on the finding's resource. |
-
trace_query |
- string | -Path: @risk_details.is_exposed_to_attacks.evidence.trace_queryQuery used to find traces with attacks related to the finding's resource. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
evidence |
- object | -Path: @risk_details.is_function_reachable.evidenceEvidence used to determine whether the function is reachable. |
-
impact_cvss |
- string | -Path: @risk_details.is_function_reachable.impact_cvssHow function reachability changes the CVSS risk assessment. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_function_reachable.valuetrue if the function is reachable; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
is_supported |
- boolean | -Path: @risk_details.is_function_reachable.evidence.is_supportedtrue if reachability analysis is supported for this finding, false otherwise. |
-
locations |
- array (object) | -Path: @risk_details.is_function_reachable.evidence.locationsArray of code locations where the function is called. |
-
not_supported_reason |
- string | -Path: @risk_details.is_function_reachable.evidence.not_supported_reasonReason why reachability analysis is not supported for this finding. Valid values: language_not_supported, vulnerable_symbol_not_available. |
-
unreachable_at |
- integer | -Path: @risk_details.is_function_reachable.evidence.unreachable_atTimestamp in milliseconds (UTC) at which the finding transitions to an unreachable state if the vulnerable function is not called. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
filename |
- string | -Path: @risk_details.is_function_reachable.evidence.locations.filenameRelative path to the file. |
-
last_detected_at |
- integer | -Path: @risk_details.is_function_reachable.evidence.locations.last_detected_atTimestamp in milliseconds (UTC) of the most recent detection of this function at the code location. |
-
line_start |
- integer | -Path: @risk_details.is_function_reachable.evidence.locations.line_startStarting line number. |
-
symbol |
- string | -Path: @risk_details.is_function_reachable.evidence.locations.symbolSymbol name at the code location. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
evidence |
- object | -Path: @risk_details.is_image_running.evidenceEvidence showing proof of running containers or hosts. |
-
impact_cvss |
- string | -Path: @risk_details.is_image_running.impact_cvssHow running containers or hosts affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_image_running.valuetrue if the image of the finding's resource has running containers or hosts; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
detected_at |
- integer | -Path: @risk_details.is_image_running.evidence.detected_atTimestamp when the running containers or hosts were detected. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
evidence |
- object | -Path: @risk_details.is_kernel_running.evidenceEvidence showing proof that the vulnerability affects the running kernel. |
-
value |
- boolean | -Path: @risk_details.is_kernel_running.valuetrue if the vulnerability affects the kernel currently running on the host; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
kernel_version |
- string | -Path: @risk_details.is_kernel_running.evidence.kernel_versionVersion of the kernel currently running on the host. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
impact_cvss |
- string | -Path: @risk_details.is_package_running.impact_cvssHow a running package affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_package_running.valuetrue if the package of the finding's resource is running; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
evidence |
- object | -Path: @risk_details.is_production.evidenceThe env tag value that determines whether the resource is in production. |
-
impact_cvss |
- string | -Path: @risk_details.is_production.impact_cvssHow production environment status affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_production.valueSame as risk.is_production. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
evidence |
- object | -Path: @risk_details.is_publicly_accessible.evidenceEvidence showing proof of access from the internet. |
-
impact_cvss |
- string | -Path: @risk_details.is_publicly_accessible.impact_cvssHow public accessibility affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_publicly_accessible.valueSame as risk.is_publicly_accessible. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
resource_key |
- string | -Path: @risk_details.is_publicly_accessible.evidence.resource_keyCanonical Cloud Resource Identifier of the resource accessible from the internet. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
impact_cvss |
- string | -Path: @risk_details.is_tainted_from_database.impact_cvssHow database tainting changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_tainted_from_database.valuetrue if the string is tainted due to originating from an untrusted database source; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
impact_cvss |
- string | -Path: @risk_details.is_tainted_from_query_string.impact_cvssHow query string tainting changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_tainted_from_query_string.valuetrue if the string contains elements derived from an HTTP query string; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
impact_cvss |
- string | -Path: @risk_details.is_tainted_from_request_url.impact_cvssHow request URL tainting changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_tainted_from_request_url.valuetrue if the final URL contains tainted parts originating from the request URL; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
impact_cvss |
- string | -Path: @risk_details.is_using_sha1.impact_cvssHow SHA1 usage changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
-
value |
- boolean | -Path: @risk_details.is_using_sha1.valuetrue if SHA1 is used in a weak hash; false otherwise. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
default_rule_id |
- string | -Path: @rule.default_rule_idDefault rule identifier of the rule. Empty if it's a custom rule. |
-
id |
- string | -Path: @rule.idIdentifier of the rule that generated the finding. |
-
name |
- string | -Path: @rule.nameName of the rule that generated the finding. |
-
type |
- string | -Path: @rule.typeType of the rule that generated the finding. |
-
version |
- integer | -Path: @rule.versionVersion of the rule that generated the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
database_monitoring |
- object | -Path: @runtime_context.database_monitoringContains database monitoring context associated with the finding. |
-
span_id |
- string | -Path: @runtime_context.span_idSpan identifier where the finding was detected. Available only for IAST (Interactive Application Security Testing). |
-
stacktrace_id |
- string | -Path: @runtime_context.stacktrace_idStack trace identifier where the finding was detected. Available only for IAST (Interactive Application Security Testing). |
-
trace_id |
- string | -Path: @runtime_context.trace_idTrace identifier where the finding was detected. Available only for IAST (Interactive Application Security Testing). |
-
vulnerable_services |
- array (object) | -Path: @runtime_context.vulnerable_servicesLists running service versions affected by the finding, each identified by deployment environment, version, and Git commit SHA. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
database_instances |
- array (string) | -Path: @runtime_context.database_monitoring.database_instancesIdentifiers for the database instances affected by the finding. |
-
query_signature |
- string | -Path: @runtime_context.database_monitoring.query_signatureHash of the normalized SQL query associated with the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
commit_sha |
- string | -Path: @runtime_context.vulnerable_services.commit_shaContains the Git commit SHA of the vulnerable service. |
-
env |
- string | -Path: @runtime_context.vulnerable_services.envIndicates the deployment environment of the vulnerable service (for example, prod, staging). |
-
service_name |
- string | -Path: @runtime_context.vulnerable_services.service_nameContains the name of the vulnerable service. |
-
version |
- string | -Path: @runtime_context.vulnerable_services.versionContains the version identifier of the vulnerable service. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
validation_status |
- string | -Path: @secret.validation_statusResult of attempting to validate if the secret is active. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
match_action_type |
- string | -Path: @sensitive_data.match_action_typeIndicates the match action configured on the Sensitive Data Scanner rule, such as redact or hash. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
git_commit_sha |
- string | -Path: @service.git_commit_shaGit commit SHA of the latest commit where the finding was detected for the service. Available only when Source Code Integration is configured. |
-
git_repository_url |
- string | -Path: @service.git_repository_urlURL of the Git repository for the service associated with the finding. Available only when Source Code Integration is configured. |
-
name |
- string | -Path: @service.nameName of the service where the finding was detected. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
adjusted |
- object | -Path: @severity_details.adjustedAdjusted severity of the finding after accounting for contextual or environmental factors. |
-
base |
- object | -Path: @severity_details.baseBase severity of the finding as defined by the original rule, advisory, or scanner, before any contextual adjustments. |
-
user_adjusted |
- object | -Path: @severity_details.user_adjustedSeverity of the finding after application of user-defined severity modifications. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
score |
- number | -Path: @severity_details.adjusted.scoreNumeric severity score (CVSS scale). |
-
value |
- string | -Path: @severity_details.adjusted.valueSeverity level. Valid values: critical, high, medium, low, info, none, unknown. |
-
value_id |
- integer | -Path: @severity_details.adjusted.value_idNumeric representation of the severity. Values: critical = 10, high = 9, medium = 7, low = 4, none = 0. |
-
vector |
- string | -Path: @severity_details.adjusted.vectorCVSS vector string. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
score |
- number | -Path: @severity_details.base.scoreNumeric severity score (CVSS scale). |
-
value |
- string | -Path: @severity_details.base.valueSeverity level. Valid values: critical, high, medium, low, info, none, unknown. |
-
value_id |
- integer | -Path: @severity_details.base.value_idNumeric representation of the severity. Values: critical = 10, high = 9, medium = 7, low = 4, none = 0. |
-
vector |
- string | -Path: @severity_details.base.vectorCVSS vector string. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
score |
- number | -Path: @severity_details.user_adjusted.scoreNumeric severity score (CVSS scale). |
-
value |
- string | -Path: @severity_details.user_adjusted.valueSeverity level. Valid values: critical, high, medium, low, info, none, unknown. |
-
value_id |
- integer | -Path: @severity_details.user_adjusted.value_idNumeric representation of the severity. Values: critical = 10, high = 9, medium = 7, low = 4, none = 0. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
confidence |
- string | -Path: @vulnerability.confidenceThe assessed likelihood of the vulnerability being a true positive. |
-
confidence_reason |
- string | -Path: @vulnerability.confidence_reasonThe rationale behind the assigned confidence level. |
-
cwes |
- array (string) | -Path: @vulnerability.cwesCWE (Common Weakness Enumeration) identifier associated with the vulnerability. Each entry must use the CWE-<id> format (for example, CWE-416). |
-
first_commit |
- string | -Path: @vulnerability.first_commitThe commit in which the vulnerability was first introduced. |
-
hash |
- string | -Path: @vulnerability.hashVulnerability hash used to correlate the same vulnerability across SCA (Software Composition Analysis) runtime and static analysis. |
-
is_emerging |
- boolean | -Path: @vulnerability.is_emergingtrue if the vulnerability is classified as an emerging threat; false otherwise. |
-
is_inherited_from_base_image |
- boolean | -Path: @vulnerability.is_inherited_from_base_imagetrue if the vulnerability originates in a base image layer, false if it originates in a layer added by the container image author. |
-
last_commit |
- string | -Path: @vulnerability.last_commitThe commit in which the vulnerability was fixed. |
-
owasp_top10_years |
- array (integer) | -Path: @vulnerability.owasp_top10_yearsThe years the vulnerability appeared in the OWASP Top 10 list of critical vulnerabilities. |
-
stack |
- object | -Path: @vulnerability.stackThe technological stack where the vulnerability was found. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
ecosystem |
- string | -Path: @vulnerability.stack.ecosystemThe package management ecosystem or source registry the vulnerable component originated from. |
-
language |
- string | -Path: @vulnerability.stack.languageThe language where the vulnerability was found. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
auto_closed_at |
- integer | -Path: @workflow.auto_closed_atTimestamp in milliseconds (UTC) when the finding was automatically closed by the system. |
-
automations |
- array (object) | -Path: @workflow.automationsInformation about any automation rules that apply to the finding. |
-
due_date |
- object | -Path: @workflow.due_dateDue date rule applied to the finding. |
-
integrations |
- object | -Path: @workflow.integrationsIntegrations like Jira, Case Management, or ServiceNow used to triage and remediate the finding. |
-
mute |
- object | -Path: @workflow.muteMuting information and metadata. |
-
severity_override |
- object | -Path: @workflow.severity_overrideMetadata about user-defined severity modifications applied to the finding. |
-
triage |
- object | -Path: @workflow.triageAssignment and status information. Assignment may be synchronized with case or Jira information. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
rule_id |
- string | -Path: @workflow.automations.rule_idUnique identifier for the automation rule. |
-
rule_name |
- string | -Path: @workflow.automations.rule_nameHuman-readable name of the automation rule applying to the finding. |
-
rule_type |
- string | -Path: @workflow.automations.rule_typeType of the automation rule applying to the finding. Valid values: due_date, mute, security_inbox, severity_modifier, ticket_creation. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
due_at |
- integer | -Path: @workflow.due_date.due_atTimestamp in milliseconds (UTC) for the finding's due date. |
-
is_overdue |
- boolean | -Path: @workflow.due_date.is_overduetrue if the due date has been reached; false otherwise. |
-
rule_id |
- string | -Path: @workflow.due_date.rule_idUnique identifier for the due date rule applied to the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
cases |
- array (object) | -Path: @workflow.integrations.casesArray of cases attached to the finding. |
-
jira |
- array (string) | -Path: @workflow.integrations.jiraJira issue keys attached to the finding in the format <PROJECT>-<NUMBER> (for example, PROJ-123). |
-
| Attribute name | -Type | -Description | -
|---|---|---|
assignee |
- object | -Path: @workflow.integrations.cases.assigneeUser assigned to the case. |
-
created_at |
- integer | -Path: @workflow.integrations.cases.created_atTimestamp in milliseconds (UTC) when the case was created. |
-
created_by |
- object | -Path: @workflow.integrations.cases.created_byUser who created the case. |
-
id |
- string | -Path: @workflow.integrations.cases.idUnique identifier of the case in UUID format. |
-
jira_issue |
- object | -Path: @workflow.integrations.cases.jira_issueJira issue attached to the case. |
-
key |
- string | -Path: @workflow.integrations.cases.keyHuman-readable identifier for the case in the format PROJECT-NUMBER (for example, CSMINV-66). |
-
linear_issue |
- object | -Path: @workflow.integrations.cases.linear_issueLinear issue attached to the case. |
-
servicenow_ticket |
- object | -Path: @workflow.integrations.cases.servicenow_ticketServiceNow ticket attached to the case. |
-
status |
- string | -Path: @workflow.integrations.cases.statusStatus of the case. |
-
title |
- string | -Path: @workflow.integrations.cases.titleTitle of the case. |
-
updated_at |
- integer | -Path: @workflow.integrations.cases.updated_atTimestamp in milliseconds (UTC) when the case was last updated. |
-
updated_by |
- object | -Path: @workflow.integrations.cases.updated_byUser who last updated the case. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
id |
- string | -Path: @workflow.integrations.cases.assignee.idUnique identifier of the user in UUID format. |
-
name |
- string | -Path: @workflow.integrations.cases.assignee.nameDisplay name of the user. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
id |
- string | -Path: @workflow.integrations.cases.created_by.idUnique identifier of the user in UUID format. |
-
name |
- string | -Path: @workflow.integrations.cases.created_by.nameDisplay name of the user. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
key |
- string | -Path: @workflow.integrations.cases.jira_issue.keyJira issue identifier in the format PROJECT-NUMBER (for example, CSMSEC-103991). |
-
status |
- string | -Path: @workflow.integrations.cases.jira_issue.statusCurrent status of the Jira issue. |
-
url |
- string | -Path: @workflow.integrations.cases.jira_issue.urlFull URL to the Jira issue. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
key |
- string | -Path: @workflow.integrations.cases.linear_issue.keyLinear issue identifier in the format TEAM-NUMBER (for example, SEC-42). |
-
status |
- string | -Path: @workflow.integrations.cases.linear_issue.statusCurrent status of the Linear issue. |
-
url |
- string | -Path: @workflow.integrations.cases.linear_issue.urlFull URL to the Linear issue. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
state |
- string | -Path: @workflow.integrations.cases.servicenow_ticket.stateCurrent state of the ServiceNow ticket. |
-
sys_id |
- string | -Path: @workflow.integrations.cases.servicenow_ticket.sys_idServiceNow 32-character hexadecimal ticket identifier (for example, 9f8c7e2d3b4a5c6d7e8f9a0b1c2d3e4f). |
-
table_name |
- string | -Path: @workflow.integrations.cases.servicenow_ticket.table_nameThe name of the table where the ticket is stored. Valid values: incident, em_event. |
-
url |
- string | -Path: @workflow.integrations.cases.servicenow_ticket.urlDirect URL to the ServiceNow ticket. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
id |
- string | -Path: @workflow.integrations.cases.updated_by.idUnique identifier of the user in UUID format. |
-
name |
- string | -Path: @workflow.integrations.cases.updated_by.nameDisplay name of the user. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
description |
- string | -Path: @workflow.mute.descriptionFree-text explanation for why the finding was muted. |
-
expire_at |
- integer | -Path: @workflow.mute.expire_atTimestamp in milliseconds (UTC) when the mute expires. If not set, the mute is permanent. |
-
is_muted |
- boolean | -Path: @workflow.mute.is_mutedtrue if the finding is muted; false if it is active. |
-
is_muted_by_rule |
- boolean | -Path: @workflow.mute.is_muted_by_ruletrue if the finding is muted by an automation rule; false otherwise. If true, the relevant automation rule is referenced in the workflow.automations section. |
-
muted_at |
- integer | -Path: @workflow.mute.muted_atTimestamp in milliseconds (UTC) when the finding was muted. |
-
muted_by |
- object | -Path: @workflow.mute.muted_byUser who muted the finding. |
-
reason |
- string | -Path: @workflow.mute.reasonReason provided for muting the finding. Valid values: none, no_pending_fix, human_error, no_longer_accepted_risk, other, pending_fix, false_positive, accepted_risk, no_fix, duplicate, risk_accepted, muted_in_code. |
-
rule_id |
- string | -Path: @workflow.mute.rule_idUnique identifier for the automation rule that muted the finding. Only set when is_muted_by_rule is true. |
-
rule_name |
- string | -Path: @workflow.mute.rule_nameHuman-readable name of the automation rule that muted the finding. Only set when is_muted_by_rule is true. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
id |
- string | -Path: @workflow.mute.muted_by.idUnique identifier of the user in UUID format. |
-
name |
- string | -Path: @workflow.mute.muted_by.nameDisplay name of the user. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
description |
- string | -Path: @workflow.severity_override.descriptionDescription of the user-defined severity modification applied to the finding. |
-
rule_id |
- string | -Path: @workflow.severity_override.rule_idIdentifier of the severity modifier automation rule that applied this severity override. Only set when the override was applied by an automation rule. |
-
rule_name |
- string | -Path: @workflow.severity_override.rule_nameName of the severity modifier automation rule that applied this severity override. Only set when the override was applied by an automation rule. |
-
updated_at |
- integer | -Path: @workflow.severity_override.updated_atTimestamp in milliseconds (UTC) when the manual severity override was applied. |
-
updated_by |
- object | -Path: @workflow.severity_override.updated_byUser who applied the manual severity override. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
id |
- string | -Path: @workflow.severity_override.updated_by.idUnique identifier of the user in UUID format. |
-
name |
- string | -Path: @workflow.severity_override.updated_by.nameDisplay name of the user. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
assignee |
- object | -Path: @workflow.triage.assigneeUser assigned to the finding. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
id |
- string | -Path: @workflow.triage.assignee.idUnique identifier in UUID format for the assignee. |
-
name |
- string | -Path: @workflow.triage.assignee.nameDisplay name of the assignee. |
-
updated_at |
- integer | -Path: @workflow.triage.assignee.updated_atTimestamp in milliseconds (UTC) when the assignee was last modified. |
-
updated_by |
- object | -Path: @workflow.triage.assignee.updated_byUser who last modified the assignee. |
-
| Attribute name | -Type | -Description | -
|---|---|---|
id |
- string | -Path: @workflow.triage.assignee.updated_by.idUnique identifier of the user in UUID format. |
-
name |
- string | -Path: @workflow.triage.assignee.updated_by.nameDisplay name of the user. |
-
| Attribute name | +Type | +Description | +
|---|---|---|
additional_resources |
+ array (object) | +Path: @additional_resourcesAdditional resources. For example, an AWS EC2 instance can have security groups and Auto Scaling groups as additional resources. |
+
base_severity |
+ string | +Path: @base_severityBase severity level of the finding before any adjustments. Valid values: critical, high, medium, low, info, none, unknown. |
+
description |
+ string | +Path: @descriptionHuman-readable explanation of the finding. May include Markdown formatting. |
+
detection_changed_at |
+ integer | +Path: @detection_changed_atTimestamp in milliseconds (UTC) when the finding's evaluation or detection state last changed. |
+
exposure_time_seconds |
+ integer | +Path: @exposure_time_secondsIndicates the time elapsed, in seconds, between when the finding was last closed and when it was first detected. |
+
finding_id |
+ string | +Path: @finding_idUnique identifier of the finding. |
+
finding_type |
+ string | +Path: @finding_typeCategory of the finding. Valid values: api_security, attack_path, runtime_code_vulnerability, static_code_vulnerability, host_and_container_vulnerability, iac_misconfiguration, identity_risk, library_vulnerability, misconfiguration, secret, workload_activity, sensitive_data. |
+
first_seen_at |
+ integer | +Path: @first_seen_atTimestamp in milliseconds (UTC) when the finding was first detected. |
+
is_in_security_inbox |
+ boolean | +Path: @is_in_security_inboxtrue if the finding appears in the Security Inbox; false otherwise. |
+
last_detected_at |
+ integer | +Path: @last_detected_atDiscovery timestamp in milliseconds (UTC) when the last detection was received by the finding platform. |
+
last_seen_at |
+ integer | +Path: @last_seen_atTimestamp in milliseconds (UTC) when the finding was most recently detected. |
+
origin |
+ array (string) | +Path: @originDetection origins that produced the finding, such as agentless scans, APM, SCA (Software Composition Analysis), or CI (Continuous Integration). |
+
related_services |
+ array (string) | +Path: @related_servicesServices that are inferred from Source Code Integration (for example, for SAST findings). |
+
resource_id |
+ string | +Path: @resource_idUnique identifier of the resource affected by the finding. |
+
resource_name |
+ string | +Path: @resource_nameHuman-readable name of the resource affected by the finding. |
+
resource_type |
+ string | +Path: @resource_typeType of the resource. |
+
severity |
+ string | +Path: @severityFinal severity level of the finding, after Datadog adjustments and any user-defined severity modifications. Valid values: critical, high, medium, low, info, none, unknown. |
+
source_finding_raw_data |
+ object | +Path: @source_finding_raw_dataRaw data from third-party integrations that generated the finding. |
+
status |
+ string | +Path: @statusWorkflow status of the finding. Valid values: open, muted, auto_closed, resolved, in-progress. |
+
time_to_resolution |
+ integer | +Path: @time_to_resolutionTime in seconds between when the finding was first detected and when it was resolved. |
+
title |
+ string | +Path: @titleHuman-readable title for the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
category |
+ string | +Path: @additional_resources.categoryCategory of the additional resource. Valid values: cloud_resource, k8s, host, service, git, iac_resource. |
+
configuration |
+ object | +Path: @additional_resources.configurationConfiguration of the additional resource. |
+
key |
+ string | +Path: @additional_resources.keyCanonical Cloud Resource Identifier (CCRID) of the additional resource when the resource is cloud-backed (for example, when category is cloud_resource). This field may be omitted for non-cloud categories such as k8s, host, service, or git. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
aliases |
+ array (string) | +Path: @advisory.aliasesAdditional identifiers referring to the same vulnerability, created by other entities. |
+
cve |
+ string | +Path: @advisory.cvePrimary globally recognized identifier for a security vulnerability, following the CVE-YYYY-NNNN format. |
+
first_remediation_available_at |
+ integer | +Path: @advisory.first_remediation_available_atTimestamp in milliseconds (UTC) when the first remediation for the advisory became available. |
+
id |
+ string | +Path: @advisory.idInternal identifier for the advisory. |
+
modified_at |
+ integer | +Path: @advisory.modified_atTimestamp in milliseconds (UTC) when the advisory was last updated. |
+
published_at |
+ integer | +Path: @advisory.published_atTimestamp in milliseconds (UTC) when the advisory was published. |
+
summary |
+ string | +Path: @advisory.summaryShort summary of the advisory. |
+
type |
+ string | +Path: @advisory.typeType of the advisory. Valid values: component_with_known_vulnerability, unmaintained, end_of_life, dangerous_workflows, risky_license, malicious_package. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
method |
+ string | +Path: @api_endpoint.methodMethod of the endpoint (HTTP verb or gRPC method). |
+
operation_name |
+ string | +Path: @api_endpoint.operation_nameName of the entry point into a service (for example, http.request, grpc.server). |
+
path |
+ string | +Path: @api_endpoint.pathRelative templated path of the endpoint. |
+
request_path |
+ string | +Path: @api_endpoint.request_pathRelative path of the endpoint. |
+
resource_name |
+ string | +Path: @api_endpoint.resource_nameInternal identification of the endpoint in the format <method> <path>. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
account |
+ string | +Path: @cloud_resource.accountCloud account that owns the cloud resource (for example, AWS account, Azure subscription, GCP project, OCI tenancy). |
+
account_name |
+ string | +Path: @cloud_resource.account_nameHuman-readable name of the cloud account owning the resource. |
+
category |
+ string | +Path: @cloud_resource.categoryCategory the resource type belongs to. |
+
cloud_provider |
+ string | +Path: @cloud_resource.cloud_providerCloud provider hosting the resource. Valid values: aws, azure, gcp, oci. |
+
cloud_provider_url |
+ string | +Path: @cloud_resource.cloud_provider_urlLink to the resource in the cloud provider console. |
+
configuration |
+ object | +Path: @cloud_resource.configurationConfiguration of the cloud resource, as returned by the cloud provider. |
+
context |
+ object | +Path: @cloud_resource.contextContext for the cloud resource. |
+
display_name |
+ string | +Path: @cloud_resource.display_nameDisplay name of the resource. |
+
key |
+ string | +Path: @cloud_resource.keyCanonical Cloud Resource Identifier (CCRID). |
+
public_accessibility_paths |
+ array (string) | +Path: @cloud_resource.public_accessibility_pathsNetwork paths through which the resource is accessible from the public internet. |
+
public_port_ranges |
+ array (object) | +Path: @cloud_resource.public_port_rangesPort ranges on the resource that are exposed to the public internet. |
+
region |
+ string | +Path: @cloud_resource.regionCloud region where the resource is located. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
from_port |
+ integer | +Path: @cloud_resource.public_port_ranges.from_portStarting port number of the exposed range. |
+
to_port |
+ integer | +Path: @cloud_resource.public_port_ranges.to_portEnding port number of the exposed range. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
column_end |
+ integer | +Path: @code_location.column_endEnding column position. |
+
column_start |
+ integer | +Path: @code_location.column_startStarting column position. |
+
filename |
+ string | +Path: @code_location.filenameRelative path to the file. |
+
is_test_file |
+ boolean | +Path: @code_location.is_test_filetrue if the code file is a test file; false otherwise. |
+
line_end |
+ integer | +Path: @code_location.line_endEnding line number. |
+
line_start |
+ integer | +Path: @code_location.line_startStarting line number. |
+
symbol |
+ string | +Path: @code_location.symbolSymbol name at the code location. |
+
url |
+ string | +Path: @code_location.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
agent |
+ object | +Path: @compliance.agentMetadata about the compliance agent that produced the finding. |
+
evaluation |
+ string | +Path: @compliance.evaluationCompliance evaluation result. Valid values: pass (resource is properly configured), fail (resource is misconfigured). |
+
frameworks |
+ array (object) | +Path: @compliance.frameworksCompliance frameworks mapped to the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
agent_framework_id |
+ string | +Path: @compliance.agent.agent_framework_idIdentifier of the compliance framework used by the agent. |
+
agent_rule_id |
+ string | +Path: @compliance.agent.agent_rule_idIdentifier of the agent rule that triggered the finding. |
+
agent_version |
+ string | +Path: @compliance.agent.agent_versionVersion of the compliance agent that produced the finding. |
+
data |
+ object | +Path: @compliance.agent.dataAdditional data produced by the compliance agent evaluation. |
+
evaluator |
+ string | +Path: @compliance.agent.evaluatorName of the evaluator that assessed the compliance finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
control |
+ string | +Path: @compliance.frameworks.controlIdentifier of the control within the compliance framework. |
+
framework |
+ string | +Path: @compliance.frameworks.frameworkIdentifier of the compliance framework (e.g., cis, pci-dss). |
+
is_default |
+ boolean | +Path: @compliance.frameworks.is_defaulttrue if this is the default framework mapping for the finding, false otherwise. |
+
requirement |
+ string | +Path: @compliance.frameworks.requirementIdentifier of the requirement within the control. |
+
version |
+ string | +Path: @compliance.frameworks.versionVersion of the compliance framework. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
architectures |
+ array (string) | +Path: @container_image.architecturesArchitectures associated with the container image. |
+
base_image |
+ object | +Path: @container_image.base_imageBase image this container image is built on. A base image is itself a container image and may have its own base_image. Absent when no base image is identified. |
+
git_repository_url |
+ string | +Path: @container_image.git_repository_urlURL of the Git repository for the code used to build the container image. Available only when Source Code Integration is configured. |
+
image_layer_diff_ids |
+ array (string) | +Path: @container_image.image_layer_diff_idsDiff IDs of the image layers, in the order they were applied. Each diff ID is the SHA256 of the uncompressed layer contents. |
+
image_layer_digests |
+ array (string) | +Path: @container_image.image_layer_digestsDigests of the image layers, in the order they were applied. Each digest is the SHA256 of the compressed layer blob. |
+
name |
+ string | +Path: @container_image.nameFull name of the container image. |
+
oses |
+ array (object) | +Path: @container_image.osesOperating systems associated with the container image. |
+
registries |
+ array (string) | +Path: @container_image.registriesContainer registry where the image is stored or was pulled from. |
+
repo_digests |
+ array (string) | +Path: @container_image.repo_digestsRepository digests of the container image where the finding was detected. |
+
repository |
+ string | +Path: @container_image.repositoryRepository of the container image. |
+
tags |
+ array (string) | +Path: @container_image.tagsTag part of the container image name (for example, latest or 1.2.3). |
+
versions |
+ array (string) | +Path: @container_image.versionsVersions of the container image where the finding was detected. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
name |
+ string | +Path: @container_image.oses.nameOperating system name. |
+
version |
+ string | +Path: @container_image.oses.versionOperating system version. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
name |
+ string | +Path: @detection_tool.nameName of the detection tool or engine that generated the finding. |
+
version |
+ string | +Path: @detection_tool.versionVersion of the detection tool or engine that generated the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
author |
+ object | +Path: @git.authorContains details about the original author of the commit, including name, email, and authoring timestamp. Remains unchanged when the commit is rebased, cherry-picked, or re-applied. |
+
branch |
+ string | +Path: @git.branchName of the Git branch related to the finding. |
+
codeowners |
+ array (string) | +Path: @git.codeownersCode owner teams extracted from the SCM (Source Control Management) provider's CODEOWNERS file on platforms like GitHub. |
+
committer |
+ object | +Path: @git.committerContains details about the person who last applied the commit to the repository, including name, email, and commit timestamp. May differ from the author when the commit is rebased, amended, or applied with git am. |
+
default_branch |
+ string | +Path: @git.default_branchDefault branch defined for the Git repository. |
+
is_default_branch |
+ boolean | +Path: @git.is_default_branchtrue if the current branch is the default branch for the repository; false otherwise. |
+
repository_id |
+ string | +Path: @git.repository_idNormalized identifier of the Git repository. |
+
repository_url |
+ string | +Path: @git.repository_urlGit repository URL related to the finding. |
+
repository_visibility |
+ string | +Path: @git.repository_visibilityVisibility of the repository. Valid values: public, private, not_detected. |
+
sha |
+ string | +Path: @git.shaGit commit identifier (SHA). |
+
| Attribute name | +Type | +Description | +
|---|---|---|
authored_at |
+ integer | +Path: @git.author.authored_atTimestamp in milliseconds (UTC) when the original changes were made. |
+
email |
+ string | +Path: @git.author.emailEmail address of the commit author. |
+
name |
+ string | +Path: @git.author.nameName of the commit author. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
committed_at |
+ integer | +Path: @git.committer.committed_atTimestamp in milliseconds (UTC) when the changes were last significantly modified (for example, during a rebase or amend operation). |
+
email |
+ string | +Path: @git.committer.emailEmail address of the committer. |
+
name |
+ string | +Path: @git.committer.nameName of the committer. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
architectures |
+ array (string) | +Path: @host.architecturesArchitectures associated with the host. |
+
cloud_provider |
+ string | +Path: @host.cloud_providerCloud provider the host belongs to. |
+
image |
+ string | +Path: @host.imageName of the host image used to build the host (for example, ami-1234). |
+
key |
+ string | +Path: @host.keyCanonical Cloud Resource Identifier (CCRID). |
+
name |
+ string | +Path: @host.nameHost name. |
+
os |
+ object | +Path: @host.osAttributes of the operating system running on the host. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
name |
+ string | +Path: @host.os.nameOperating system name. |
+
version |
+ string | +Path: @host.os.versionOperating system version. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
platform |
+ string | +Path: @iac_resource.platformIaC (Infrastructure as Code) platform the vulnerability was found on (for example, terraform, kubernetes). |
+
provider |
+ string | +Path: @iac_resource.providerIaC (Infrastructure as Code) provider where the resource is defined (for example, aws, gcp, azure). |
+
| Attribute name | +Type | +Description | +
|---|---|---|
cluster_id |
+ string | +Path: @k8s.cluster_idKubernetes cluster identifier. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
schema_version |
+ string | +Path: @metadata.schema_versionIndicates the findings schema version used for the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
additional_names |
+ array (string) | +Path: @package.additional_namesAdditional affected package names, if the cloud vulnerability impacted multiple packages derived from the same source package. |
+
declaration |
+ object | +Path: @package.declarationCode locations of the package definition. |
+
dependency_location_text |
+ string | +Path: @package.dependency_location_textText representation of the dependency location, such as the file path where the vulnerable package is declared. |
+
dependency_type |
+ string | +Path: @package.dependency_typeWhether the package is a direct dependency, transitive dependency, or not supported if the information cannot be retrieved. |
+
has_suid |
+ boolean | +Path: @package.has_suidtrue if the package has the SUID bit set; false otherwise. |
+
is_running |
+ boolean | +Path: @package.is_runningtrue if the package is currently running; false otherwise. |
+
is_running_as_root |
+ boolean | +Path: @package.is_running_as_roottrue if the package is currently running as root; false otherwise. |
+
loading_type |
+ string | +Path: @package.loading_typeWhether the component is always loaded and running ( hot), running infrequently (cold), or loaded on demand (lazy). |
+
manager |
+ string | +Path: @package.managerPackage management ecosystem or source registry the vulnerable component originates from. |
+
name |
+ string | +Path: @package.nameName of the package or library where the vulnerability was identified. |
+
normalized_name |
+ string | +Path: @package.normalized_nameNormalized name according to the ecosystem of the package or library where the vulnerability was identified. |
+
root_parents |
+ array (object) | +Path: @package.root_parentsList of dependencies for which the package is a transitive dependency. |
+
scope |
+ string | +Path: @package.scopeIntended usage scope of the package ( production or development). |
+
version |
+ string | +Path: @package.versionVersion of the package or library where the vulnerability was identified. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
block |
+ object | +Path: @package.declaration.blockLocation of the code that declares the whole dependency declaration. |
+
name |
+ object | +Path: @package.declaration.nameLocation of the code that declares the dependency name. |
+
version |
+ object | +Path: @package.declaration.versionVersion declared for the root parent. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
column_end |
+ integer | +Path: @package.declaration.block.column_endEnding column position. |
+
column_start |
+ integer | +Path: @package.declaration.block.column_startStarting column position. |
+
filename |
+ string | +Path: @package.declaration.block.filenameRelative path to the file. |
+
is_test_file |
+ boolean | +Path: @package.declaration.block.is_test_filetrue if the code file is a test file; false otherwise. |
+
line_end |
+ integer | +Path: @package.declaration.block.line_endEnding line number. |
+
line_start |
+ integer | +Path: @package.declaration.block.line_startStarting line number. |
+
symbol |
+ string | +Path: @package.declaration.block.symbolSymbol name at the code location. |
+
url |
+ string | +Path: @package.declaration.block.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
column_end |
+ integer | +Path: @package.declaration.name.column_endEnding column position. |
+
column_start |
+ integer | +Path: @package.declaration.name.column_startStarting column position. |
+
filename |
+ string | +Path: @package.declaration.name.filenameRelative path to the file. |
+
is_test_file |
+ boolean | +Path: @package.declaration.name.is_test_filetrue if the code file is a test file; false otherwise. |
+
line_end |
+ integer | +Path: @package.declaration.name.line_endEnding line number. |
+
line_start |
+ integer | +Path: @package.declaration.name.line_startStarting line number. |
+
symbol |
+ string | +Path: @package.declaration.name.symbolSymbol name at the code location. |
+
url |
+ string | +Path: @package.declaration.name.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
column_end |
+ integer | +Path: @package.declaration.version.column_endEnding column position. |
+
column_start |
+ integer | +Path: @package.declaration.version.column_startStarting column position. |
+
filename |
+ string | +Path: @package.declaration.version.filenameRelative path to the file. |
+
is_test_file |
+ boolean | +Path: @package.declaration.version.is_test_filetrue if the code file is a test file; false otherwise. |
+
line_end |
+ integer | +Path: @package.declaration.version.line_endEnding line number. |
+
line_start |
+ integer | +Path: @package.declaration.version.line_startStarting line number. |
+
symbol |
+ string | +Path: @package.declaration.version.symbolSymbol name at the code location. |
+
url |
+ string | +Path: @package.declaration.version.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
declaration |
+ object | +Path: @package.root_parents.declarationLocation of the code that declares the version of a root parent. |
+
language |
+ string | +Path: @package.root_parents.languageDependency language for which the package is a transitive dependency. |
+
name |
+ string | +Path: @package.root_parents.nameDependency name for which the package is a transitive dependency. |
+
version |
+ string | +Path: @package.root_parents.versionDependency version for which the package is a transitive dependency. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
block |
+ object | +Path: @package.root_parents.declaration.blockLocation of the code that declares the whole dependency declaration. |
+
name |
+ object | +Path: @package.root_parents.declaration.nameLocation of the code that declares the dependency name. |
+
version |
+ object | +Path: @package.root_parents.declaration.versionVersion declared for the root parent. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
column_end |
+ integer | +Path: @package.root_parents.declaration.block.column_endEnding column position. |
+
column_start |
+ integer | +Path: @package.root_parents.declaration.block.column_startStarting column position. |
+
filename |
+ string | +Path: @package.root_parents.declaration.block.filenameRelative path to the file. |
+
is_test_file |
+ boolean | +Path: @package.root_parents.declaration.block.is_test_filetrue if the code file is a test file; false otherwise. |
+
line_end |
+ integer | +Path: @package.root_parents.declaration.block.line_endEnding line number. |
+
line_start |
+ integer | +Path: @package.root_parents.declaration.block.line_startStarting line number. |
+
symbol |
+ string | +Path: @package.root_parents.declaration.block.symbolSymbol name at the code location. |
+
url |
+ string | +Path: @package.root_parents.declaration.block.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
column_end |
+ integer | +Path: @package.root_parents.declaration.name.column_endEnding column position. |
+
column_start |
+ integer | +Path: @package.root_parents.declaration.name.column_startStarting column position. |
+
filename |
+ string | +Path: @package.root_parents.declaration.name.filenameRelative path to the file. |
+
is_test_file |
+ boolean | +Path: @package.root_parents.declaration.name.is_test_filetrue if the code file is a test file; false otherwise. |
+
line_end |
+ integer | +Path: @package.root_parents.declaration.name.line_endEnding line number. |
+
line_start |
+ integer | +Path: @package.root_parents.declaration.name.line_startStarting line number. |
+
symbol |
+ string | +Path: @package.root_parents.declaration.name.symbolSymbol name at the code location. |
+
url |
+ string | +Path: @package.root_parents.declaration.name.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
column_end |
+ integer | +Path: @package.root_parents.declaration.version.column_endEnding column position. |
+
column_start |
+ integer | +Path: @package.root_parents.declaration.version.column_startStarting column position. |
+
filename |
+ string | +Path: @package.root_parents.declaration.version.filenameRelative path to the file. |
+
is_test_file |
+ boolean | +Path: @package.root_parents.declaration.version.is_test_filetrue if the code file is a test file; false otherwise. |
+
line_end |
+ integer | +Path: @package.root_parents.declaration.version.line_endEnding line number. |
+
line_start |
+ integer | +Path: @package.root_parents.declaration.version.line_startStarting line number. |
+
symbol |
+ string | +Path: @package.root_parents.declaration.version.symbolSymbol name at the code location. |
+
url |
+ string | +Path: @package.root_parents.declaration.version.urlURL to view the file online (for example, in GitHub), highlighting the code location. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
code_update |
+ object | +Path: @remediation.code_updateCode changes to apply to remediate the finding. |
+
codegen |
+ object | +Path: @remediation.codegenFinding status for the code generation platform. |
+
container_image |
+ object | +Path: @remediation.container_imageNewer container image version that may remediate the vulnerability. |
+
description |
+ string | +Path: @remediation.descriptionDescription of the remediation. |
+
host_image |
+ object | +Path: @remediation.host_imageLatest host image version that may remediate the vulnerability. |
+
is_available |
+ boolean | +Path: @remediation.is_availabletrue if a remediation is currently available for the finding; false otherwise. |
+
microsoft_kb |
+ object | +Path: @remediation.microsoft_kbRemediation strategy using a Microsoft Knowledge Base (KB) article. |
+
package |
+ object | +Path: @remediation.packageRemediation package information. |
+
recommended |
+ object | +Path: @remediation.recommendedRecommended remediation details. |
+
recommended_type |
+ string | +Path: @remediation.recommended_typeRecommended remediation type for the finding. |
+
root_package |
+ object | +Path: @remediation.root_packageRemediation root package information. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
edits |
+ array (object) | +Path: @remediation.code_update.editsCode changes required to remediate the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
column_end |
+ integer | +Path: @remediation.code_update.edits.column_endEnding column position of the code change. |
+
column_start |
+ integer | +Path: @remediation.code_update.edits.column_startStarting column position of the code change. |
+
content |
+ string | +Path: @remediation.code_update.edits.contentContents of the code change. |
+
line_end |
+ integer | +Path: @remediation.code_update.edits.line_endEnding line number of the code change. |
+
line_start |
+ integer | +Path: @remediation.code_update.edits.line_startStarting line number of the code change. |
+
type |
+ string | +Path: @remediation.code_update.edits.typeNature of the code change. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
id |
+ string | +Path: @remediation.codegen.idIdentifier used to track the remediation in the code generation backend. |
+
status |
+ string | +Path: @remediation.codegen.statusStatus of the automated fix generation. Valid values: generated, not_available_non_default_branch, not_available_unsupported_tool, not_available_unsupported_rule, not_available_disabled, not_available_git_provider_not_supported, not_available_confidence_too_low, error, not_available_has_deterministic_fixes, not_available_unknown_reason, not_available_org_not_onboarded, not_available_repository_disabled, not_available_unsupported_resource_type, not_available_unsupported_ecosystem, not_available_severity_too_low, not_available_transitive_library, not_available_no_remediation, not_available_unsupported_vulnerability_type. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
closest_no_vulnerabilities |
+ object | +Path: @remediation.container_image.closest_no_vulnerabilitiesClosest container image version with no vulnerabilities. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
image_url |
+ string | +Path: @remediation.container_image.closest_no_vulnerabilities.image_urlURL of the container image that may remediate the vulnerability. |
+
layer_digests |
+ array (string) | +Path: @remediation.container_image.closest_no_vulnerabilities.layer_digestsLayer digests of the currently vulnerable container image that needs to be upgraded. |
+
name |
+ string | +Path: @remediation.container_image.closest_no_vulnerabilities.nameName of the container image that may remediate the vulnerability. |
+
tag |
+ string | +Path: @remediation.container_image.closest_no_vulnerabilities.tagTag of the container image that may remediate the vulnerability. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
latest_major |
+ object | +Path: @remediation.host_image.latest_majorInformation about the latest Amazon Machine Image (AMI) that may remediate the vulnerability. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
name |
+ string | +Path: @remediation.host_image.latest_major.nameName of the latest Amazon Machine Image (for example, ami-12345678) that may remediate the vulnerability. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
closest_fix_advisory |
+ object | +Path: @remediation.microsoft_kb.closest_fix_advisoryThe closest patch available to address the current advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
article |
+ string | +Path: @remediation.microsoft_kb.closest_fix_advisory.articleArticle name for the closest patch. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base |
+ array (object) | +Path: @remediation.package.baseCurrent package version that the finding was detected on, before any remediation is applied. |
+
closest_minimum_risk_only_no_fix_vulnerabilities |
+ array (object) | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilitiesClosest package version that only contains vulnerabilities for which no fix is available, minimizing risk exposure. |
+
closest_no_critical |
+ array (object) | +Path: @remediation.package.closest_no_criticalClosest package version with no critical vulnerabilities (based on base score). |
+
closest_no_vulnerabilities |
+ array (object) | +Path: @remediation.package.closest_no_vulnerabilitiesClosest package version with no vulnerabilities. |
+
latest_no_critical |
+ array (object) | +Path: @remediation.package.latest_no_criticalThe latest remediation package version with no critical vulnerabilities (based on base score). |
+
latest_no_vulnerabilities |
+ array (object) | +Path: @remediation.package.latest_no_vulnerabilitiesLatest package version with no vulnerabilities. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.package.base.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.package.base.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.package.base.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.package.base.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.package.base.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.package.base.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.package.base.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.package.base.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.base.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.base.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.base.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.base.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.base.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.base.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.closest_minimum_risk_only_no_fix_vulnerabilities.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.package.closest_no_critical.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.package.closest_no_critical.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.package.closest_no_critical.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.package.closest_no_critical.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.package.closest_no_critical.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.package.closest_no_critical.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.package.closest_no_critical.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.package.closest_no_critical.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.closest_no_critical.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.closest_no_critical.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.closest_no_critical.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.closest_no_critical.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.closest_no_critical.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.closest_no_critical.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.package.closest_no_vulnerabilities.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.package.closest_no_vulnerabilities.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.package.closest_no_vulnerabilities.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.package.closest_no_vulnerabilities.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.package.closest_no_vulnerabilities.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.package.closest_no_vulnerabilities.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.package.closest_no_vulnerabilities.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.package.closest_no_vulnerabilities.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.closest_no_vulnerabilities.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.closest_no_vulnerabilities.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.closest_no_vulnerabilities.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.closest_no_vulnerabilities.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.closest_no_vulnerabilities.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.closest_no_vulnerabilities.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.package.latest_no_critical.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.package.latest_no_critical.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.package.latest_no_critical.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.package.latest_no_critical.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.package.latest_no_critical.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.package.latest_no_critical.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.package.latest_no_critical.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.package.latest_no_critical.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.latest_no_critical.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.latest_no_critical.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.latest_no_critical.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.latest_no_critical.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.latest_no_critical.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.latest_no_critical.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.package.latest_no_vulnerabilities.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.package.latest_no_vulnerabilities.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.package.latest_no_vulnerabilities.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.package.latest_no_vulnerabilities.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.package.latest_no_vulnerabilities.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.package.latest_no_vulnerabilities.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.package.latest_no_vulnerabilities.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.package.latest_no_vulnerabilities.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.latest_no_vulnerabilities.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.latest_no_vulnerabilities.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.latest_no_vulnerabilities.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.latest_no_vulnerabilities.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.package.latest_no_vulnerabilities.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.package.latest_no_vulnerabilities.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base |
+ array (object) | +Path: @remediation.root_package.baseCurrent package version that the finding was detected on, before any remediation is applied. |
+
closest_minimum_risk_only_no_fix_vulnerabilities |
+ array (object) | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilitiesClosest package version that only contains vulnerabilities for which no fix is available, minimizing risk exposure. |
+
closest_no_critical |
+ array (object) | +Path: @remediation.root_package.closest_no_criticalClosest package version with no critical vulnerabilities (based on base score). |
+
closest_no_vulnerabilities |
+ array (object) | +Path: @remediation.root_package.closest_no_vulnerabilitiesClosest package version with no vulnerabilities. |
+
latest_no_critical |
+ array (object) | +Path: @remediation.root_package.latest_no_criticalThe latest remediation package version with no critical vulnerabilities (based on base score). |
+
latest_no_vulnerabilities |
+ array (object) | +Path: @remediation.root_package.latest_no_vulnerabilitiesLatest package version with no vulnerabilities. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.root_package.base.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.root_package.base.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.root_package.base.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.root_package.base.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.root_package.base.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.root_package.base.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.root_package.base.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.root_package.base.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.base.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.base.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.base.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.base.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.base.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.base.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.closest_minimum_risk_only_no_fix_vulnerabilities.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.root_package.closest_no_critical.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.root_package.closest_no_critical.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.root_package.closest_no_critical.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.root_package.closest_no_critical.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.root_package.closest_no_critical.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.root_package.closest_no_critical.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.root_package.closest_no_critical.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.root_package.closest_no_critical.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.closest_no_critical.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.closest_no_critical.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.closest_no_critical.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.closest_no_critical.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.closest_no_critical.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.closest_no_critical.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.root_package.closest_no_vulnerabilities.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.root_package.closest_no_vulnerabilities.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.root_package.closest_no_vulnerabilities.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.root_package.closest_no_vulnerabilities.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.root_package.closest_no_vulnerabilities.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.root_package.closest_no_vulnerabilities.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.root_package.closest_no_vulnerabilities.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.root_package.closest_no_vulnerabilities.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.closest_no_vulnerabilities.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.closest_no_vulnerabilities.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.closest_no_vulnerabilities.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.closest_no_vulnerabilities.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.closest_no_vulnerabilities.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.closest_no_vulnerabilities.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.root_package.latest_no_critical.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.root_package.latest_no_critical.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.root_package.latest_no_critical.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.root_package.latest_no_critical.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.root_package.latest_no_critical.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.root_package.latest_no_critical.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.root_package.latest_no_critical.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.root_package.latest_no_critical.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.latest_no_critical.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.latest_no_critical.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.latest_no_critical.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.latest_no_critical.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.latest_no_critical.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.latest_no_critical.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
fixed_advisories |
+ array (object) | +Path: @remediation.root_package.latest_no_vulnerabilities.fixed_advisoriesAdvisories that the remediation will fix. |
+
has_incomplete_data |
+ boolean | +Path: @remediation.root_package.latest_no_vulnerabilities.has_incomplete_dataFlag to indicate whether the remediation may have incomplete dependency data and therefore may not be 100% accurate. |
+
is_auto_solvable |
+ boolean | +Path: @remediation.root_package.latest_no_vulnerabilities.is_auto_solvableFlag to indicate whether the remediation is autosolvable (only recompiling is needed) |
+
name |
+ string | +Path: @remediation.root_package.latest_no_vulnerabilities.nameRecommended package name that fixes the finding. |
+
new_advisories |
+ array (object) | +Path: @remediation.root_package.latest_no_vulnerabilities.new_advisoriesAdvisories that will appear if the remediation is applied. |
+
original_name |
+ string | +Path: @remediation.root_package.latest_no_vulnerabilities.original_nameOriginal name of the recommended package that fixes the finding. |
+
remaining_advisories |
+ array (object) | +Path: @remediation.root_package.latest_no_vulnerabilities.remaining_advisoriesAdvisories that will remain unfixed if the remediation is applied. |
+
version |
+ string | +Path: @remediation.root_package.latest_no_vulnerabilities.versionRecommended package version that fixes the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.latest_no_vulnerabilities.fixed_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.latest_no_vulnerabilities.fixed_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.latest_no_vulnerabilities.new_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.latest_no_vulnerabilities.new_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
base_severity |
+ string | +Path: @remediation.root_package.latest_no_vulnerabilities.remaining_advisories.base_severityBase severity of the advisory. |
+
id |
+ string | +Path: @remediation.root_package.latest_no_vulnerabilities.remaining_advisories.idIdentifier of the advisory. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
has_exploit_available |
+ boolean | +Path: @risk.has_exploit_availabletrue if known exploits exist for the finding; false otherwise. |
+
has_high_exploitability_chance |
+ boolean | +Path: @risk.has_high_exploitability_chancetrue if the EPSS (Exploit Prediction Scoring System) score is above 1%; false otherwise. |
+
has_privileged_access |
+ boolean | +Path: @risk.has_privileged_accesstrue if the finding's resource is running with elevated privileges or has the ability to assume a privileged role; false otherwise. |
+
has_sensitive_data |
+ boolean | +Path: @risk.has_sensitive_datatrue if the finding has access to a resource that contains sensitive data; false otherwise. |
+
is_authenticated |
+ boolean | +Path: @risk.is_authenticatedtrue if the API endpoint requires authentication to access; false if the endpoint does not require authentication. Omitted if authentication status is unknown. |
+
is_crown_jewel |
+ boolean | +Path: @risk.is_crown_jeweltrue if the affected resource is critical to your business; false otherwise. |
+
is_emerging |
+ boolean | +Path: @risk.is_emergingtrue if the vulnerability is linked to an advisory classified as an emerging vulnerability; false otherwise. |
+
is_exposed_to_attacks |
+ boolean | +Path: @risk.is_exposed_to_attackstrue if attacks have already been detected on the resource; false otherwise. |
+
is_function_reachable |
+ boolean | +Path: @risk.is_function_reachabletrue if the vulnerable function can be executed; false otherwise. |
+
is_image_running |
+ boolean | +Path: @risk.is_image_runningtrue if the image of the finding's resource has running containers or hosts; false otherwise. |
+
is_kernel_running |
+ boolean | +Path: @risk.is_kernel_runningtrue if the vulnerability affects the kernel currently running on the host; false otherwise. |
+
is_package_running |
+ boolean | +Path: @risk.is_package_runningtrue if the package of the finding's resource is running; false otherwise. |
+
is_production |
+ boolean | +Path: @risk.is_productiontrue if the finding's resource is running in production; false otherwise. |
+
is_publicly_accessible |
+ boolean | +Path: @risk.is_publicly_accessibletrue if the finding's resource is publicly accessible; false otherwise. |
+
is_tainted_from_database |
+ boolean | +Path: @risk.is_tainted_from_databasetrue if the string is tainted due to originating from an untrusted database source; false otherwise. |
+
is_tainted_from_query_string |
+ boolean | +Path: @risk.is_tainted_from_query_stringtrue if the string is tainted with elements derived from an HTTP query string; false otherwise. |
+
is_tainted_from_request_url |
+ boolean | +Path: @risk.is_tainted_from_request_urltrue if the final URL contains tainted parts originating from the request URL; false otherwise. |
+
is_using_sha1 |
+ boolean | +Path: @risk.is_using_sha1true if SHA1 is used in a weak hash; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
has_exploit_available |
+ object | +Path: @risk_details.has_exploit_availableInformation about whether a known exploit exists for the finding advisory. |
+
has_high_exploitability_chance |
+ object | +Path: @risk_details.has_high_exploitability_chanceEvidence and indicators about whether the vulnerability is likely to be exploited based on EPSS (Exploit Prediction Scoring System). |
+
has_privileged_access |
+ object | +Path: @risk_details.has_privileged_accessEvidence and indicators about whether the resource has privileged access. |
+
has_sensitive_data |
+ object | +Path: @risk_details.has_sensitive_dataEvidence and indicators about whether the affected resource has sensitive data. |
+
is_authenticated |
+ object | +Path: @risk_details.is_authenticatedEvidence and indicators about whether the API endpoint requires authentication. |
+
is_crown_jewel |
+ object | +Path: @risk_details.is_crown_jewelEvidence and indicators about whether the affected resource is critical. |
+
is_emerging |
+ object | +Path: @risk_details.is_emergingEvidence and indicators about whether the vulnerability is classified as an emerging vulnerability. |
+
is_exposed_to_attacks |
+ object | +Path: @risk_details.is_exposed_to_attacksEvidence and indicators about whether the service where the finding was detected is exposed to attacks. |
+
is_function_reachable |
+ object | +Path: @risk_details.is_function_reachableEvidence and indicators about whether the vulnerable function or module is used in the code. |
+
is_image_running |
+ object | +Path: @risk_details.is_image_runningEvidence and indicators about whether the affected image has running containers or hosts. |
+
is_kernel_running |
+ object | +Path: @risk_details.is_kernel_runningEvidence and indicators about whether the vulnerability affects the kernel currently running on the host. |
+
is_package_running |
+ object | +Path: @risk_details.is_package_runningEvidence and indicators about whether the affected package is running. |
+
is_production |
+ object | +Path: @risk_details.is_productionEvidence and indicators about whether the resource associated with the finding is running in a production environment. |
+
is_publicly_accessible |
+ object | +Path: @risk_details.is_publicly_accessibleInformation about whether the affected resource is accessible from the public internet. |
+
is_tainted_from_database |
+ object | +Path: @risk_details.is_tainted_from_databaseInformation about whether tainted parts originate from a database. |
+
is_tainted_from_query_string |
+ object | +Path: @risk_details.is_tainted_from_query_stringInformation about whether the tainted parts originated from a query string. |
+
is_tainted_from_request_url |
+ object | +Path: @risk_details.is_tainted_from_request_urlInformation about whether the tainted parts originate from the request URL. |
+
is_using_sha1 |
+ object | +Path: @risk_details.is_using_sha1Information about whether SHA1 is used in a weak hash. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
evidence |
+ object | +Path: @risk_details.has_exploit_available.evidenceEvidence of exploit availability. |
+
impact_cvss |
+ string | +Path: @risk_details.has_exploit_available.impact_cvssHow the availability of known exploits changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.has_exploit_available.valuetrue if known exploits exist for the finding; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
exploit_sources |
+ array (string) | +Path: @risk_details.has_exploit_available.evidence.exploit_sourcesExploit sources associated with the finding (for example, NIST, CISA, Exploit-DB). |
+
exploit_urls |
+ array (string) | +Path: @risk_details.has_exploit_available.evidence.exploit_urlsExploit URLs associated with the finding. |
+
type |
+ string | +Path: @risk_details.has_exploit_available.evidence.typeType of exploit availability evidence. Valid values: production_ready, poc, unavailable. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
evidence |
+ object | +Path: @risk_details.has_high_exploitability_chance.evidenceEvidence for the EPSS score. |
+
impact_cvss |
+ string | +Path: @risk_details.has_high_exploitability_chance.impact_cvssHow high exploitability chance affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.has_high_exploitability_chance.valuetrue if the EPSS score is above 1%; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
epss_score |
+ number | +Path: @risk_details.has_high_exploitability_chance.evidence.epss_scoreEPSS score as a percentage representing the chance of exploitation. |
+
epss_severity |
+ string | +Path: @risk_details.has_high_exploitability_chance.evidence.epss_severityEPSS score severity level. Valid values: Critical, High, Medium, Low. |
+
threshold |
+ number | +Path: @risk_details.has_high_exploitability_chance.evidence.thresholdMinimum EPSS score required for a vulnerability to be considered as having a high exploitability chance. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
evidence |
+ object | +Path: @risk_details.has_privileged_access.evidenceEvidence showing proof of privileged access. |
+
impact_cvss |
+ string | +Path: @risk_details.has_privileged_access.impact_cvssHow privileged access changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.has_privileged_access.valuetrue if the resource associated with the finding has privileged access; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
resource_key |
+ string | +Path: @risk_details.has_privileged_access.evidence.resource_keyCanonical Cloud Resource Identifier with proof of privileged access. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
evidence |
+ object | +Path: @risk_details.has_sensitive_data.evidenceEvidence supporting the presence of sensitive data. |
+
impact_cvss |
+ string | +Path: @risk_details.has_sensitive_data.impact_cvssHow sensitive data presence changes the CVSS score. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.has_sensitive_data.valueSame as risk.has_sensitive_data. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
sds_id |
+ string | +Path: @risk_details.has_sensitive_data.evidence.sds_idIdentifier of a sensitive data entry that Datadog Sensitive Data Scanner detected. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
value |
+ boolean | +Path: @risk_details.is_authenticated.valueSame as risk.is_authenticated. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
evidence |
+ object | +Path: @risk_details.is_crown_jewel.evidenceEvidence used to identify the resource as being critical. |
+
impact_cvss |
+ string | +Path: @risk_details.is_crown_jewel.impact_cvssHow resource criticality changes the CVSS score. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_crown_jewel.valuetrue if the resource is critical to your business; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
explanation |
+ string | +Path: @risk_details.is_crown_jewel.evidence.explanationExplanation detailing why the resource or related resource is identified as critical. |
+
related_resource_name |
+ string | +Path: @risk_details.is_crown_jewel.evidence.related_resource_nameName of a long-lived critical asset, such as a critical service, that justifies why the affected resource is considered critical. |
+
sensitive_data |
+ array (string) | +Path: @risk_details.is_crown_jewel.evidence.sensitive_dataSensitive data types detected on the resource that contribute to its classification as a critical asset (for example, visa_credit_card). |
+
| Attribute name | +Type | +Description | +
|---|---|---|
impact_cvss |
+ string | +Path: @risk_details.is_emerging.impact_cvssHow emerging vulnerability status affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_emerging.valueSame as risk.is_emerging. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
evidence |
+ object | +Path: @risk_details.is_exposed_to_attacks.evidenceEvidence for the presence of attacks. |
+
impact_cvss |
+ string | +Path: @risk_details.is_exposed_to_attacks.impact_cvssHow the resource's exposure affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_exposed_to_attacks.valueSame as risk.is_exposed_to_attacks. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
attacks_details |
+ object | +Path: @risk_details.is_exposed_to_attacks.evidence.attacks_detailsDetails about one of the detected attacks. |
+
trace_example |
+ object | +Path: @risk_details.is_exposed_to_attacks.evidence.trace_exampleExample of a trace with attacks detected on the finding's resource. |
+
trace_query |
+ string | +Path: @risk_details.is_exposed_to_attacks.evidence.trace_queryQuery used to find traces with attacks related to the finding's resource. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
evidence |
+ object | +Path: @risk_details.is_function_reachable.evidenceEvidence used to determine whether the function is reachable. |
+
impact_cvss |
+ string | +Path: @risk_details.is_function_reachable.impact_cvssHow function reachability changes the CVSS risk assessment. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_function_reachable.valuetrue if the function is reachable; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
is_supported |
+ boolean | +Path: @risk_details.is_function_reachable.evidence.is_supportedtrue if reachability analysis is supported for this finding, false otherwise. |
+
locations |
+ array (object) | +Path: @risk_details.is_function_reachable.evidence.locationsArray of code locations where the function is called. |
+
not_supported_reason |
+ string | +Path: @risk_details.is_function_reachable.evidence.not_supported_reasonReason why reachability analysis is not supported for this finding. Valid values: language_not_supported, vulnerable_symbol_not_available. |
+
unreachable_at |
+ integer | +Path: @risk_details.is_function_reachable.evidence.unreachable_atTimestamp in milliseconds (UTC) at which the finding transitions to an unreachable state if the vulnerable function is not called. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
filename |
+ string | +Path: @risk_details.is_function_reachable.evidence.locations.filenameRelative path to the file. |
+
last_detected_at |
+ integer | +Path: @risk_details.is_function_reachable.evidence.locations.last_detected_atTimestamp in milliseconds (UTC) of the most recent detection of this function at the code location. |
+
line_start |
+ integer | +Path: @risk_details.is_function_reachable.evidence.locations.line_startStarting line number. |
+
symbol |
+ string | +Path: @risk_details.is_function_reachable.evidence.locations.symbolSymbol name at the code location. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
evidence |
+ object | +Path: @risk_details.is_image_running.evidenceEvidence showing proof of running containers or hosts. |
+
impact_cvss |
+ string | +Path: @risk_details.is_image_running.impact_cvssHow running containers or hosts affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_image_running.valuetrue if the image of the finding's resource has running containers or hosts; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
detected_at |
+ integer | +Path: @risk_details.is_image_running.evidence.detected_atTimestamp when the running containers or hosts were detected. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
evidence |
+ object | +Path: @risk_details.is_kernel_running.evidenceEvidence showing proof that the vulnerability affects the running kernel. |
+
value |
+ boolean | +Path: @risk_details.is_kernel_running.valuetrue if the vulnerability affects the kernel currently running on the host; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
kernel_version |
+ string | +Path: @risk_details.is_kernel_running.evidence.kernel_versionVersion of the kernel currently running on the host. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
impact_cvss |
+ string | +Path: @risk_details.is_package_running.impact_cvssHow a running package affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_package_running.valuetrue if the package of the finding's resource is running; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
evidence |
+ object | +Path: @risk_details.is_production.evidenceThe env tag value that determines whether the resource is in production. |
+
impact_cvss |
+ string | +Path: @risk_details.is_production.impact_cvssHow production environment status affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_production.valueSame as risk.is_production. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
evidence |
+ object | +Path: @risk_details.is_publicly_accessible.evidenceEvidence showing proof of access from the internet. |
+
impact_cvss |
+ string | +Path: @risk_details.is_publicly_accessible.impact_cvssHow public accessibility affects the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_publicly_accessible.valueSame as risk.is_publicly_accessible. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
resource_key |
+ string | +Path: @risk_details.is_publicly_accessible.evidence.resource_keyCanonical Cloud Resource Identifier of the resource accessible from the internet. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
impact_cvss |
+ string | +Path: @risk_details.is_tainted_from_database.impact_cvssHow database tainting changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_tainted_from_database.valuetrue if the string is tainted due to originating from an untrusted database source; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
impact_cvss |
+ string | +Path: @risk_details.is_tainted_from_query_string.impact_cvssHow query string tainting changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_tainted_from_query_string.valuetrue if the string contains elements derived from an HTTP query string; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
impact_cvss |
+ string | +Path: @risk_details.is_tainted_from_request_url.impact_cvssHow request URL tainting changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_tainted_from_request_url.valuetrue if the final URL contains tainted parts originating from the request URL; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
impact_cvss |
+ string | +Path: @risk_details.is_using_sha1.impact_cvssHow SHA1 usage changes the CVSS scoring. Valid values: riskier, neutral, safer, unknown. |
+
value |
+ boolean | +Path: @risk_details.is_using_sha1.valuetrue if SHA1 is used in a weak hash; false otherwise. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
default_rule_id |
+ string | +Path: @rule.default_rule_idDefault rule identifier of the rule. Empty if it's a custom rule. |
+
id |
+ string | +Path: @rule.idIdentifier of the rule that generated the finding. |
+
name |
+ string | +Path: @rule.nameName of the rule that generated the finding. |
+
type |
+ string | +Path: @rule.typeType of the rule that generated the finding. |
+
version |
+ integer | +Path: @rule.versionVersion of the rule that generated the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
database_monitoring |
+ object | +Path: @runtime_context.database_monitoringContains database monitoring context associated with the finding. |
+
span_id |
+ string | +Path: @runtime_context.span_idSpan identifier where the finding was detected. Available only for IAST (Interactive Application Security Testing). |
+
stacktrace_id |
+ string | +Path: @runtime_context.stacktrace_idStack trace identifier where the finding was detected. Available only for IAST (Interactive Application Security Testing). |
+
trace_id |
+ string | +Path: @runtime_context.trace_idTrace identifier where the finding was detected. Available only for IAST (Interactive Application Security Testing). |
+
vulnerable_services |
+ array (object) | +Path: @runtime_context.vulnerable_servicesLists running service versions affected by the finding, each identified by deployment environment, version, and Git commit SHA. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
database_instances |
+ array (string) | +Path: @runtime_context.database_monitoring.database_instancesIdentifiers for the database instances affected by the finding. |
+
query_signature |
+ string | +Path: @runtime_context.database_monitoring.query_signatureHash of the normalized SQL query associated with the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
commit_sha |
+ string | +Path: @runtime_context.vulnerable_services.commit_shaContains the Git commit SHA of the vulnerable service. |
+
env |
+ string | +Path: @runtime_context.vulnerable_services.envIndicates the deployment environment of the vulnerable service (for example, prod, staging). |
+
service_name |
+ string | +Path: @runtime_context.vulnerable_services.service_nameContains the name of the vulnerable service. |
+
version |
+ string | +Path: @runtime_context.vulnerable_services.versionContains the version identifier of the vulnerable service. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
validation_status |
+ string | +Path: @secret.validation_statusResult of attempting to validate if the secret is active. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
match_action_type |
+ string | +Path: @sensitive_data.match_action_typeIndicates the match action configured on the Sensitive Data Scanner rule, such as redact or hash. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
git_commit_sha |
+ string | +Path: @service.git_commit_shaGit commit SHA of the latest commit where the finding was detected for the service. Available only when Source Code Integration is configured. |
+
git_repository_url |
+ string | +Path: @service.git_repository_urlURL of the Git repository for the service associated with the finding. Available only when Source Code Integration is configured. |
+
name |
+ string | +Path: @service.nameName of the service where the finding was detected. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
adjusted |
+ object | +Path: @severity_details.adjustedAdjusted severity of the finding after accounting for contextual or environmental factors. |
+
base |
+ object | +Path: @severity_details.baseBase severity of the finding as defined by the original rule, advisory, or scanner, before any contextual adjustments. |
+
user_adjusted |
+ object | +Path: @severity_details.user_adjustedSeverity of the finding after application of user-defined severity modifications. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
score |
+ number | +Path: @severity_details.adjusted.scoreNumeric severity score (CVSS scale). |
+
value |
+ string | +Path: @severity_details.adjusted.valueSeverity level. Valid values: critical, high, medium, low, info, none, unknown. |
+
value_id |
+ integer | +Path: @severity_details.adjusted.value_idNumeric representation of the severity. Values: critical = 10, high = 9, medium = 7, low = 4, none = 0. |
+
vector |
+ string | +Path: @severity_details.adjusted.vectorCVSS vector string. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
score |
+ number | +Path: @severity_details.base.scoreNumeric severity score (CVSS scale). |
+
value |
+ string | +Path: @severity_details.base.valueSeverity level. Valid values: critical, high, medium, low, info, none, unknown. |
+
value_id |
+ integer | +Path: @severity_details.base.value_idNumeric representation of the severity. Values: critical = 10, high = 9, medium = 7, low = 4, none = 0. |
+
vector |
+ string | +Path: @severity_details.base.vectorCVSS vector string. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
score |
+ number | +Path: @severity_details.user_adjusted.scoreNumeric severity score (CVSS scale). |
+
value |
+ string | +Path: @severity_details.user_adjusted.valueSeverity level. Valid values: critical, high, medium, low, info, none, unknown. |
+
value_id |
+ integer | +Path: @severity_details.user_adjusted.value_idNumeric representation of the severity. Values: critical = 10, high = 9, medium = 7, low = 4, none = 0. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
confidence |
+ string | +Path: @vulnerability.confidenceThe assessed likelihood of the vulnerability being a true positive. |
+
confidence_reason |
+ string | +Path: @vulnerability.confidence_reasonThe rationale behind the assigned confidence level. |
+
cwes |
+ array (string) | +Path: @vulnerability.cwesCWE (Common Weakness Enumeration) identifier associated with the vulnerability. Each entry must use the CWE-<id> format (for example, CWE-416). |
+
first_commit |
+ string | +Path: @vulnerability.first_commitThe commit in which the vulnerability was first introduced. |
+
hash |
+ string | +Path: @vulnerability.hashVulnerability hash used to correlate the same vulnerability across SCA (Software Composition Analysis) runtime and static analysis. |
+
is_emerging |
+ boolean | +Path: @vulnerability.is_emergingtrue if the vulnerability is classified as an emerging threat; false otherwise. |
+
is_inherited_from_base_image |
+ boolean | +Path: @vulnerability.is_inherited_from_base_imagetrue if the vulnerability originates in a base image layer, false if it originates in a layer added by the container image author. |
+
last_commit |
+ string | +Path: @vulnerability.last_commitThe commit in which the vulnerability was fixed. |
+
owasp_top10_years |
+ array (integer) | +Path: @vulnerability.owasp_top10_yearsThe years the vulnerability appeared in the OWASP Top 10 list of critical vulnerabilities. |
+
stack |
+ object | +Path: @vulnerability.stackThe technological stack where the vulnerability was found. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
ecosystem |
+ string | +Path: @vulnerability.stack.ecosystemThe package management ecosystem or source registry the vulnerable component originated from. |
+
language |
+ string | +Path: @vulnerability.stack.languageThe language where the vulnerability was found. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
auto_closed_at |
+ integer | +Path: @workflow.auto_closed_atTimestamp in milliseconds (UTC) when the finding was automatically closed by the system. |
+
automations |
+ array (object) | +Path: @workflow.automationsInformation about any automation rules that apply to the finding. |
+
due_date |
+ object | +Path: @workflow.due_dateDue date rule applied to the finding. |
+
integrations |
+ object | +Path: @workflow.integrationsIntegrations like Jira, Case Management, or ServiceNow used to triage and remediate the finding. |
+
mute |
+ object | +Path: @workflow.muteMuting information and metadata. |
+
severity_override |
+ object | +Path: @workflow.severity_overrideMetadata about user-defined severity modifications applied to the finding. |
+
triage |
+ object | +Path: @workflow.triageAssignment and status information. Assignment may be synchronized with case or Jira information. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
rule_id |
+ string | +Path: @workflow.automations.rule_idUnique identifier for the automation rule. |
+
rule_name |
+ string | +Path: @workflow.automations.rule_nameHuman-readable name of the automation rule applying to the finding. |
+
rule_type |
+ string | +Path: @workflow.automations.rule_typeType of the automation rule applying to the finding. Valid values: due_date, mute, security_inbox, severity_modifier, ticket_creation. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
due_at |
+ integer | +Path: @workflow.due_date.due_atTimestamp in milliseconds (UTC) for the finding's due date. |
+
is_overdue |
+ boolean | +Path: @workflow.due_date.is_overduetrue if the due date has been reached; false otherwise. |
+
rule_id |
+ string | +Path: @workflow.due_date.rule_idUnique identifier for the due date rule applied to the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
cases |
+ array (object) | +Path: @workflow.integrations.casesArray of cases attached to the finding. |
+
jira |
+ array (string) | +Path: @workflow.integrations.jiraJira issue keys attached to the finding in the format <PROJECT>-<NUMBER> (for example, PROJ-123). |
+
| Attribute name | +Type | +Description | +
|---|---|---|
assignee |
+ object | +Path: @workflow.integrations.cases.assigneeUser assigned to the case. |
+
created_at |
+ integer | +Path: @workflow.integrations.cases.created_atTimestamp in milliseconds (UTC) when the case was created. |
+
created_by |
+ object | +Path: @workflow.integrations.cases.created_byUser who created the case. |
+
id |
+ string | +Path: @workflow.integrations.cases.idUnique identifier of the case in UUID format. |
+
jira_issue |
+ object | +Path: @workflow.integrations.cases.jira_issueJira issue attached to the case. |
+
key |
+ string | +Path: @workflow.integrations.cases.keyHuman-readable identifier for the case in the format PROJECT-NUMBER (for example, CSMINV-66). |
+
linear_issue |
+ object | +Path: @workflow.integrations.cases.linear_issueLinear issue attached to the case. |
+
servicenow_ticket |
+ object | +Path: @workflow.integrations.cases.servicenow_ticketServiceNow ticket attached to the case. |
+
status |
+ string | +Path: @workflow.integrations.cases.statusStatus of the case. |
+
title |
+ string | +Path: @workflow.integrations.cases.titleTitle of the case. |
+
updated_at |
+ integer | +Path: @workflow.integrations.cases.updated_atTimestamp in milliseconds (UTC) when the case was last updated. |
+
updated_by |
+ object | +Path: @workflow.integrations.cases.updated_byUser who last updated the case. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
id |
+ string | +Path: @workflow.integrations.cases.assignee.idUnique identifier of the user in UUID format. |
+
name |
+ string | +Path: @workflow.integrations.cases.assignee.nameDisplay name of the user. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
id |
+ string | +Path: @workflow.integrations.cases.created_by.idUnique identifier of the user in UUID format. |
+
name |
+ string | +Path: @workflow.integrations.cases.created_by.nameDisplay name of the user. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
key |
+ string | +Path: @workflow.integrations.cases.jira_issue.keyJira issue identifier in the format PROJECT-NUMBER (for example, CSMSEC-103991). |
+
status |
+ string | +Path: @workflow.integrations.cases.jira_issue.statusCurrent status of the Jira issue. |
+
url |
+ string | +Path: @workflow.integrations.cases.jira_issue.urlFull URL to the Jira issue. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
key |
+ string | +Path: @workflow.integrations.cases.linear_issue.keyLinear issue identifier in the format TEAM-NUMBER (for example, SEC-42). |
+
status |
+ string | +Path: @workflow.integrations.cases.linear_issue.statusCurrent status of the Linear issue. |
+
url |
+ string | +Path: @workflow.integrations.cases.linear_issue.urlFull URL to the Linear issue. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
state |
+ string | +Path: @workflow.integrations.cases.servicenow_ticket.stateCurrent state of the ServiceNow ticket. |
+
sys_id |
+ string | +Path: @workflow.integrations.cases.servicenow_ticket.sys_idServiceNow 32-character hexadecimal ticket identifier (for example, 9f8c7e2d3b4a5c6d7e8f9a0b1c2d3e4f). |
+
table_name |
+ string | +Path: @workflow.integrations.cases.servicenow_ticket.table_nameThe name of the table where the ticket is stored. Valid values: incident, em_event. |
+
url |
+ string | +Path: @workflow.integrations.cases.servicenow_ticket.urlDirect URL to the ServiceNow ticket. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
id |
+ string | +Path: @workflow.integrations.cases.updated_by.idUnique identifier of the user in UUID format. |
+
name |
+ string | +Path: @workflow.integrations.cases.updated_by.nameDisplay name of the user. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
description |
+ string | +Path: @workflow.mute.descriptionFree-text explanation for why the finding was muted. |
+
expire_at |
+ integer | +Path: @workflow.mute.expire_atTimestamp in milliseconds (UTC) when the mute expires. If not set, the mute is permanent. |
+
is_muted |
+ boolean | +Path: @workflow.mute.is_mutedtrue if the finding is muted; false if it is active. |
+
is_muted_by_rule |
+ boolean | +Path: @workflow.mute.is_muted_by_ruletrue if the finding is muted by an automation rule; false otherwise. If true, the relevant automation rule is referenced in the workflow.automations section. |
+
muted_at |
+ integer | +Path: @workflow.mute.muted_atTimestamp in milliseconds (UTC) when the finding was muted. |
+
muted_by |
+ object | +Path: @workflow.mute.muted_byUser who muted the finding. |
+
reason |
+ string | +Path: @workflow.mute.reasonReason provided for muting the finding. Valid values: none, no_pending_fix, human_error, no_longer_accepted_risk, other, pending_fix, false_positive, accepted_risk, no_fix, duplicate, risk_accepted, muted_in_code. |
+
rule_id |
+ string | +Path: @workflow.mute.rule_idUnique identifier for the automation rule that muted the finding. Only set when is_muted_by_rule is true. |
+
rule_name |
+ string | +Path: @workflow.mute.rule_nameHuman-readable name of the automation rule that muted the finding. Only set when is_muted_by_rule is true. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
id |
+ string | +Path: @workflow.mute.muted_by.idUnique identifier of the user in UUID format. |
+
name |
+ string | +Path: @workflow.mute.muted_by.nameDisplay name of the user. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
description |
+ string | +Path: @workflow.severity_override.descriptionDescription of the user-defined severity modification applied to the finding. |
+
rule_id |
+ string | +Path: @workflow.severity_override.rule_idIdentifier of the severity modifier automation rule that applied this severity override. Only set when the override was applied by an automation rule. |
+
rule_name |
+ string | +Path: @workflow.severity_override.rule_nameName of the severity modifier automation rule that applied this severity override. Only set when the override was applied by an automation rule. |
+
updated_at |
+ integer | +Path: @workflow.severity_override.updated_atTimestamp in milliseconds (UTC) when the manual severity override was applied. |
+
updated_by |
+ object | +Path: @workflow.severity_override.updated_byUser who applied the manual severity override. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
id |
+ string | +Path: @workflow.severity_override.updated_by.idUnique identifier of the user in UUID format. |
+
name |
+ string | +Path: @workflow.severity_override.updated_by.nameDisplay name of the user. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
assignee |
+ object | +Path: @workflow.triage.assigneeUser assigned to the finding. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
id |
+ string | +Path: @workflow.triage.assignee.idUnique identifier in UUID format for the assignee. |
+
name |
+ string | +Path: @workflow.triage.assignee.nameDisplay name of the assignee. |
+
updated_at |
+ integer | +Path: @workflow.triage.assignee.updated_atTimestamp in milliseconds (UTC) when the assignee was last modified. |
+
updated_by |
+ object | +Path: @workflow.triage.assignee.updated_byUser who last modified the assignee. |
+
| Attribute name | +Type | +Description | +
|---|---|---|
id |
+ string | +Path: @workflow.triage.assignee.updated_by.idUnique identifier of the user in UUID format. |
+
name |
+ string | +Path: @workflow.triage.assignee.updated_by.nameDisplay name of the user. |
+