dictionary.json

{
  "caption": "Attribute Dictionary",
  "description": "The Attribute Dictionary defines schema attributes and includes references to the events and objects in which they are used.",
  "name": "dictionary",
  "attributes": {
    "adjusted_metric_list": {
      "caption": "Adjusted Metric List",
      "description": "A list of CVSS environmental metrics that were modified by the vendor, including the metric name and the reason for the modification.",
      "type": "adjusted_metric",
      "is_array": true
    },
    "adjusted_score": {
      "caption": "Adjusted Score",
      "description": "The recalculated CVSS score after environmental modifications are applied by the vendor.",
      "type": "float_t"
    },
    "adjusted_vector_string": {
      "caption": "Adjusted Vector String",
      "description": "The modified CVSS scoring vector with environmental metrics appended by the vendor.",
      "type": "string_t"
    },
    "attach_time": {
      "caption": "Attach Time",
      "description": "The time stamp when the volume was attached to the instance",
      "type": "timestamp_t"
    },
    "attachments": {
      "caption": "List of Attachments",
      "description": "A list of attachments to the resource",
      "type": "attachment",
      "is_array": true
    },
    "cidr_block": {
      "caption": "CIDR Block",
      "description": "The CIDR block of the subnet",
      "type": "subnet_t"
    },
    "cloud_function": {
      "caption": "Cloud Function",
      "description": "The cloud function that processes events",
      "type": "cloud_function"
    },
    "cluster_members": {
      "caption": "Database Cluster Members",
      "description": "List of database instance that are part of the database cluster.",
      "type": "string_t",
      "is_array": true
    },
    "cluster_uid": {
      "caption": "Cluster UID",
      "description": "The unique identifier for the container cluster",
      "type": "string_t"
    },
    "content_policy_filters": {
      "caption": "Content Policy Filters",
      "description": "A list of content policy filter results from an AI guardrail evaluation. Each filter describes the assessment of content against a specific category such as hate speech, violence, or prompt attacks.",
      "type": "content_policy_filter",
      "is_array": true
    },
    "contributing_findings": {
      "caption": "Contributing Findings",
      "description": "A list of contributing finding objects describing the before and after state of each finding affected by a remediation target.",
      "type": "contributing_finding",
      "is_array": true
    },
    "cvss_metric": {
      "caption": "CVSS Metric",
      "description": "The CVSS environmental metric that was modified. Values correspond to CVSS v3.x/v4.0 environmental metric abbreviations.",
      "type": "string_t"
    },
    "db_cluster": {
      "caption": "Database Cluster",
      "description": "The details of the database cluster.",
      "type": "db_cluster"
    },
    "db_endpoint": {
      "caption": "Database Endpoint",
      "description": "The database endpoint that is associated with the resource",
      "type": "network_endpoint"
    },
    "db_user": {
      "caption": "Database User",
      "description": "The details of the user account that is the database administrator (e.g. admin).",
      "type": "user"
    },
    "engine": {
      "caption": "Engine",
      "description": "The engine that is associated with the database",
      "type": "string_t"
    },
    "guardrail_evaluation_result": {
      "caption": "Guardrail Evaluation Result",
      "description": "The aggregate outcome of an AI guardrail evaluation, including the source of content evaluated and the combined content policy filter results.",
      "type": "guardrail_evaluation_result"
    },
    "handler": {
      "caption": "Handler",
      "description": "The method in the cloud function that processes events",
      "type": "string_t"
    },
    "hosted_zone_uid": {
      "caption": "Hosted Zone UID",
      "description": "The unique identifier of a hosted zone <code>(e.g. AWS Route 53 Hosted Zone)</code>.",
      "type": "string_t"
    },
    "imported_time": {
      "caption": "Imported Date and Time",
      "description": "The timestamp when the certificate was imported",
      "type": "timestamp_t"
    },
    "in_use_by": {
      "caption": "In Use By",
      "description": "List of resources currently using this certificate",
      "type": "string_t",
      "is_array": true
    },
    "in_use_count": {
      "caption": "In Use Count",
      "description": "Count of resources using this image. See specific usage.",
      "type": "integer_t"
    },
    "instance_profile": {
      "caption": "Instance Profile",
      "description": "Information about the instance profile associated with the compute resource, which provides the resource with permissions to interact with other services",
      "type": "instance_profile"
    },
    "instance_profiles": {
      "caption": "Instance Profiles",
      "description": "A list of instance profiles associated with the compute resource, which provides the resource with permissions to interact with other services",
      "type": "instance_profile",
      "is_array": true
    },
    "ip_addresses": {
      "caption": "IP Address Array ",
      "description": "An array of IP addresses (IPv4 or IPv6) associated with the instance. These may include both public and private IP addresses.",
      "type": "ip_t",
      "is_array": true
    },
    "ip_count": {
      "caption": "IP Count",
      "description": "The number of IP addresses in the subnet",
      "type": "integer_t"
    },
    "is_delete_on_termination": {
      "caption": "Is Delete on Termination",
      "description": "Specifies whether the volume will be deleted on instance termination",
      "type": "boolean_t"
    },
    "is_iam_authentication": {
      "caption": "IAM Database Authentication Enabled",
      "description": "Indicates if IAM database authentication is enabled",
      "type": "boolean_t"
    },
    "is_immediate": {
      "caption": "Is Immediate",
      "description": "Indicates whether the remediation fix takes effect immediately upon application, or requires additional rollout steps such as redeployment of affected resources.",
      "type": "boolean_t"
    },
    "key_usages": {
      "caption": "Key Usages",
      "description": " Key usage defines the purpose of the key contained in the certificate. ",
      "type": "string_t",
      "enum": {
        "ANY": {
          "caption": "ANY",
          "description": "The public key can be used for any purpose."
        },
        "CERTIFICATE_SIGNING": {
          "caption": "CERTIFICATE_SIGNING",
          "description": "Used when the public key is used for verifying a signature on certificates."
        },
        "CRL_SIGNING": {
          "caption": "CRL_SIGNING",
          "description": "Used when the public key is used for verifying a signature on Certificate Revocation Lists."
        },
        "CUSTOM": {
          "caption": "CUSTOM",
          "description": "A custom usage defined by the event source."
        },
        "DATA_ENCIPHERMENT": {
          "caption": "DATA_ENCIPHERMENT",
          "description": "Used when the public key is used for directly encrypting user data."
        },
        "DECIPHER_ONLY": {
          "caption": "DECIPHER_ONLY",
          "description": "Used only for deciphering data during key agreement."
        },
        "DIGITAL_SIGNATURE": {
          "caption": "DIGITAL_SIGNATURE",
          "description": "Used when the public key is used for verifying digital signatures."
        },
        "ENCIPHER_ONLY": {
          "caption": "ENCIPHER_ONLY",
          "description": "Used only for enciphering data during key agreement."
        },
        "KEY_AGREEMENT": {
          "caption": "KEY_AGREEMENT",
          "description": "Used when the sender and receiver of the public key need to derive a key without using encryption."
        },
        "KEY_ENCIPHERMENT": {
          "caption": "KEY_ENCIPHERMENT",
          "description": "Used when the public key is used for encrypting private or secret keys."
        },
        "NON_REPUDIATION": {
          "caption": "NON_REPUDIATION",
          "description": "Used when the public key is used to verify digital signatures used for non-repudiation services."
        }
      },
      "references": [
        {
          "description": "RFC 5280",
          "url": "https://www.rfc-editor.org/rfc/rfc5280"
        }
      ],
      "is_array": true
    },
    "last_used_time": {
      "caption": "Last Used time",
      "description": "The time stamp when the resource was last used. See specific usage.",
      "type": "timestamp_t"
    },
    "launch_time": {
      "caption": "Launch Time",
      "description": "The reported time a device or instance was launched",
      "type": "timestamp_t"
    },
    "layers": {
      "caption": "Cloud Function Layers",
      "description": "The list of layers associated with the cloud function.",
      "type": "layer",
      "is_array": true
    },
    "likelihood": {
      "caption": "Likelihood",
      "description": "The likelihood, normalized to the caption of the <code>likelihood_id</code> value. In the case of 'Other', it is defined by the event source.",
      "type": "string_t"
    },
    "likelihood_id": {
      "caption": "Likelihood ID",
      "description": "The normalized likelihood of the finding. Per NIST, this is a weighted factor based on a subjective analysis of the probability that a given threat is capable of exploiting a given vulnerability or a set of vulnerabilities.",
      "sibling": "likelihood",
      "type": "integer_t",
      "enum": {
        "0": {
          "caption": "Unknown",
          "description": "The normalized likelihood is unknown."
        },
        "1": {
          "caption": "Very Low",
          "description": "The probability of the threat exploiting the vulnerability is very low."
        },
        "2": {
          "caption": "Low",
          "description": "The probability of the threat exploiting the vulnerability is low."
        },
        "3": {
          "caption": "Moderate",
          "description": "The probability of the threat exploiting the vulnerability is moderate."
        },
        "4": {
          "caption": "High",
          "description": "The probability of the threat exploiting the vulnerability is high."
        },
        "5": {
          "caption": "Very High",
          "description": "The probability of the threat exploiting the vulnerability is very high."
        },
        "99": {
          "caption": "Other",
          "description": "The likelihood is not mapped to the defined enum values. See the <code>likelihood</code> attribute, which contains a data source specific value."
        }
      },
      "references": [
        {
          "description": "NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments",
          "url": "https://doi.org/10.6028/NIST.SP.800-30r1"
        },
        {
          "description": "NIST Computer Security Resource Center",
          "url": "https://csrc.nist.gov/glossary/term/likelihood"
        }
      ]
    },
    "network_interface": {
      "caption": "Network Interface",
      "description": "The Network Interface object describes the type and associated attributes of a physical or virtual network interface.",
      "type": "network_interface"
    },
    "network_scan_info": {
      "caption": "Network Scan Info",
      "description": "The network scan job metadata object describing scan timestamps, completion status, scanner endpoints, and operational flags.",
      "type": "network_scan_info"
    },
    "platform": {
      "caption": "Platform Name",
      "description": "The operating system platform of the image. See specific usage.",
      "type": "string_t"
    },
    "port_info": {
      "caption": "Port Info",
      "description": "The port and transport protocol details.",
      "type": "port_info"
    },
    "port_scan_result_list": {
      "caption": "Port Scan Result List",
      "description": "A list of port scan result objects, each describing the probe outcome for a single port on the scanned host.",
      "type": "port_scan_result",
      "is_array": true
    },
    "post_remediation_steps": {
      "caption": "Post-Remediation Steps",
      "description": "An ordered list of follow-up remediation steps to perform after the primary fix is applied, such as redeploying affected instances or rotating credentials.",
      "type": "remediation_step",
      "is_array": true
    },
    "registry_uid": {
      "caption": "Registry UID",
      "description": "The unique identifier of a container registry (e.g. AWS ECR Registry ID).",
      "type": "string_t"
    },
    "remediation_outcome": {
      "caption": "Remediation Outcome",
      "description": "The aggregate outcome of remediating a target resource, including counts of resolved, severity-reduced, and unchanged findings, and per-finding before/after detail.",
      "type": "remediation_outcome"
    },
    "renewable_eligibility": {
      "caption": "Renewable Eligibility",
      "description": "Indicates if the certificate is eligible for renewal",
      "type": "string_t"
    },
    "repository_name": {
      "caption": "Repository Name",
      "description": "The name of the repository. See specific usage.",
      "type": "string_t"
    },
    "resolved_findings_count": {
      "caption": "Resolved Findings Count",
      "description": "The number of findings that will be fully resolved by remediating this target.",
      "type": "integer_t"
    },
    "root_device_type": {
      "caption": "Root Device Type",
      "description": "The type of root device the machine image uses <code>(e.g. ebs, instance-store)</code>.",
      "type": "string_t"
    },
    "workload_state": {
      "caption": "Workload State",
      "description": "The workload state of the affected package, normalized to the caption of the <code>workload_state_id</code> value. In the case of 'Other', it is defined by the event source.",
      "type": "string_t"
    },
    "workload_state_id": {
      "caption": "Workload State ID",
      "description": "The normalized workload state of an affected package on the resource: whether the package was determined to be part of the workload the resource runs. The evidence behind the value is described by <code>workload_state_reason</code>.",
      "sibling": "workload_state",
      "type": "integer_t",
      "enum": {
        "0": {
          "caption": "Unknown",
          "description": "The workload state is unknown. The scanner did not evaluate workload state for this package, or the resource type does not support it."
        },
        "1": {
          "caption": "Active",
          "description": "The package was determined to be part of the workload the resource runs <code>(e.g. a running process was observed on the EC2 instance, or the package is on the container image workload path)</code>."
        },
        "2": {
          "caption": "Inactive",
          "description": "The package is installed but was not determined to be part of the workload the resource runs <code>(e.g. no running process was observed on the EC2 instance, or the package is not on the container image workload path)</code>."
        },
        "99": {
          "caption": "Other",
          "description": "The workload state is not mapped. See the <code>workload_state</code> attribute, which contains a data source specific value."
        }
      }
    },
    "workload_state_reason": {
      "caption": "Workload State Reason",
      "description": "The evidence the scanner used to determine the <code>workload_state_id</code> of an affected package.",
      "type": "string_t",
      "enum": {
        "PACKAGE_IN_DOCKERFILE_WORKLOAD_PATH": {
          "caption": "PACKAGE_IN_DOCKERFILE_WORKLOAD_PATH",
          "description": "The package is on the workload path declared by the container image's Dockerfile <code>(e.g. ENTRYPOINT, CMD, WORKDIR)</code>. Implies workload state Active."
        },
        "PACKAGE_NOT_IN_DOCKERFILE_WORKLOAD_PATH": {
          "caption": "PACKAGE_NOT_IN_DOCKERFILE_WORKLOAD_PATH",
          "description": "The package is present in the container image but not on the workload path declared by its Dockerfile. Implies workload state Inactive."
        },
        "PROCESS_NOT_OBSERVED_IN_EC2_RUNTIME": {
          "caption": "PROCESS_NOT_OBSERVED_IN_EC2_RUNTIME",
          "description": "No running process backed by the package was observed on the EC2 instance during the observation window. Implies workload state Inactive."
        },
        "PROCESS_OBSERVED_IN_EC2_RUNTIME": {
          "caption": "PROCESS_OBSERVED_IN_EC2_RUNTIME",
          "description": "A running process backed by the package was observed on the EC2 instance. Implies workload state Active."
        }
      }
    },
    "scan_duration": {
      "caption": "Scan Duration",
      "description": "The time span of the network scan job, including start time, end time, and total duration.",
      "type": "timespan"
    },
    "scanner_endpoint": {
      "caption": "Scanner Endpoint",
      "description": "The network endpoint of the scanner source that executed the scan probes.",
      "type": "network_endpoint"
    },
    "security_groups": {
      "caption": "Array of Security groups",
      "description": "The array of security groups associated with the resource",
      "type": "security_group",
      "is_array": true
    },
    "severity_reduction_findings_count": {
      "caption": "Severity Reduction Findings Count",
      "description": "The number of findings that will have reduced severity after remediating this target.",
      "type": "integer_t"
    },
    "severity_unchanged_findings_count": {
      "caption": "Severity Unchanged Findings Count",
      "description": "The number of findings that will remain at the same severity after remediating this target.",
      "type": "integer_t"
    },
    "snapshot_details": {
      "caption": "Snapshot Details",
      "description": "The details of the database snapshot.",
      "type": "snapshot_details"
    },
    "snapshot_id": {
      "caption": "Snapshot ID",
      "description": "The storage device snapshot identifier <code>(e.g. snap-1234567890abcdef0).</code>",
      "type": "string_t"
    },
    "source_resource_uid": {
      "caption": "Source Resource UID",
      "description": "The unique identifier of the resource the machine image was created from <code>(e.g. the source AMI or instance id)</code>.",
      "type": "string_t"
    },
    "storage_device": {
      "caption": "Storage Device",
      "description": "The storage device that is attached to the instance",
      "type": "storage_device"
    },
    "subnet_group": {
      "caption": "Subnet Group",
      "description": "The subnet group that is associated with the database",
      "type": "subnet_group"
    },
    "subnet_info": {
      "caption": "Subnet Information",
      "description": "Describes the supporting information about a subnet.",
      "type": "subnet_info"
    },
    "subnet_info_list": {
      "caption": "List of Subnet Information",
      "description": "A list of supporting information about a subnet.",
      "type": "subnet_info",
      "is_array": true
    },
    "target_trait": {
      "caption": "Target Trait",
      "description": "The security trait that this remediation target addresses. One remediation target finding is generated per resource type and trait combination.",
      "type": "trait"
    },
    "tcp_banner": {
      "caption": "TCP Banner",
      "description": "A sanitized snippet of a service banner received from a scanned port over TCP, such as an SSH greeting, SMTP 220 response, or FTP welcome message.",
      "type": "string_t"
    },
    "update_reason": {
      "caption": "Update Reason",
      "description": "The reason a CVSS metric was modified by the vendor.",
      "type": "string_t"
    },
    "updated_severity": {
      "caption": "Updated Severity",
      "description": "The projected severity of the finding after remediation, normalized to the caption of the <code>updated_severity_id</code> value.",
      "type": "string_t"
    },
    "updated_severity_id": {
      "caption": "Updated Severity ID",
      "description": "The projected normalized severity identifier of the finding after remediation. Values mirror the core OCSF <code>severity_id</code> enum.",
      "sibling": "updated_severity",
      "type": "integer_t",
      "enum": {
        "0": {
          "caption": "Unknown",
          "description": "The severity is unknown."
        },
        "1": {
          "caption": "Informational",
          "description": "Informational message. No action required."
        },
        "2": {
          "caption": "Low",
          "description": "The user decides if action is needed."
        },
        "3": {
          "caption": "Medium",
          "description": "Action is required but the situation is not serious at this time."
        },
        "4": {
          "caption": "High",
          "description": "Action is required immediately."
        },
        "5": {
          "caption": "Critical",
          "description": "Action is required immediately and the scope is broad."
        },
        "6": {
          "caption": "Fatal",
          "description": "An error occurred but it is too late to take remedial action."
        },
        "99": {
          "caption": "Other",
          "description": "The severity is not mapped. See the <code>updated_severity</code> attribute, which contains a data source specific value."
        }
      }
    },
    "updated_traits": {
      "caption": "Updated Traits",
      "description": "The security traits that will remain on the finding after remediation.",
      "type": "trait",
      "is_array": true
    },
    "vendor_score": {
      "caption": "Vendor Score",
      "description": "The vendor-determined score for the finding, reflecting any adjustments applied by the event source. For example, the vendor's adjusted CVSS score after applying environmental metrics.",
      "type": "float_t"
    },
    "virtualization_type": {
      "caption": "Virtualization Type",
      "description": "The virtualization type of the machine image <code>(e.g. hvm, paravirtual)</code>.",
      "type": "string_t"
    },
    "zones": {
      "caption": "List of Availability Zones",
      "description": "A list of availability zones",
      "type": "string_t",
      "is_array": true
    }
  }
}