> For the complete documentation index, see [llms.txt](https://breachtrace.gitbook.io/vulnkeeper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breachtrace.gitbook.io/vulnkeeper/chapter-b/06-6-recommended-canonical-data-model-coverage.md).

# 6. Recommended canonical data model coverage

A complete vulnerability impact system should be able to ingest or derive the following fields.

## 6.1 Vulnerability identity

<table><thead><tr><th width="87.23828125" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>CVE ID</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject/cvelistV5">github.com/CVEProject/cvelistV5</a>, <a href="https://www.cve.org/">www.cve.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Canonical vulnerability identifier.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Not all advisories have CVEs immediately.</td></tr><tr><td align="right">2</td><td><strong>GHSA ID</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/advisories">github.com/advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> GitHub Security Advisory identifier.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> May exist without CVE.</td></tr><tr><td align="right">3</td><td><strong>OSV ID</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://osv.dev/">osv.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> OSV vulnerability identifier.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Links package-specific affectedness &#x26; aliases.</td></tr><tr><td align="right">4</td><td><strong>Vendor advisory ID</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://msrc.microsoft.com/update-guide">msrc.microsoft.com/update-guide</a>, <a href="https://www.oracle.com/security-alerts/">www.oracle.com/security-alerts</a><br><br><strong><code>Access / Cost</code>:</strong> Mostly free public; some support details may require entitlement</td><td><strong><code>Relevance</code>:</strong> Vendor-specific advisory identifier.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Often most authoritative for product-specific truth.</td></tr><tr><td align="right">5</td><td><strong>CWE ID</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cwe.mitre.org/">cwe.mitre.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Weakness class identifier.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Quality of mapping varies.</td></tr><tr><td align="right">6</td><td><strong>CAPEC ID</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://capec.mitre.org/">capec.mitre.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Attack-pattern identifier.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for attack mechanism mapping.</td></tr><tr><td align="right">7</td><td><strong>ATT&#x26;CK technique ID</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://attack.mitre.org/matrices/enterprise/">attack.mitre.org/matrices/enterprise</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Adversary technique identifier.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for detection/response mapping.</td></tr><tr><td align="right">8</td><td><strong>ATLAS technique ID</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://atlas.mitre.org/techniques">atlas.mitre.org/techniques</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> AI/ML adversary technique identifier.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Relevant for AI systems.</td></tr><tr><td align="right">9</td><td><strong>Alias graph</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject/cvelistV5">github.com/CVEProject/cvelistV5</a>, <a href="https://github.com/advisories">github.com/advisories</a>, <a href="https://osv.dev/">osv.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Maps CVE/GHSA/OSV/vendor aliases.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Crucial for deduplication &#x26; correlation.</td></tr></tbody></table>

## 6.2 Affectedness

<table><thead><tr><th width="93.34375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Product name</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://nvd.nist.gov/products/cpe">nvd.nist.gov/products/cpe</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Identifies vulnerable products.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Normalize against CPE/PURL/vendor data.</td></tr><tr><td align="right">2</td><td><strong>Vendor</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cve.org/">www.cve.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Vendor/product attribution.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Vendor naming can differ across sources.</td></tr><tr><td align="right">3</td><td><strong>CPE</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://nvd.nist.gov/developers/products">nvd.nist.gov/developers/products</a><br><br><strong><code>Access / Cost</code>:</strong> Free public; optional free API key for higher rate limits</td><td><strong><code>Relevance</code>:</strong> Product/platform matching.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Imprecise for many OSS packages.</td></tr><tr><td align="right">4</td><td><strong>PURL</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/package-url/purl-spec">github.com/package-url/purl-spec</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Package identity.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Prefer for package ecosystem matching.</td></tr><tr><td align="right">5</td><td><strong>Package ecosystem</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://osv.dev/list">osv.dev/list</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Defines package namespace &#x26; version rules.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Version semantics are ecosystem-specific.</td></tr><tr><td align="right">6</td><td><strong>Package name</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://deps.dev/">deps.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Dependency identity.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Normalize casing &#x26; namespace rules.</td></tr><tr><td align="right">7</td><td><strong>Affected version range</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://ossf.github.io/osv-schema/">ossf.github.io/osv-schema</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open-source</td><td><strong><code>Relevance</code>:</strong> Expresses vulnerable versions.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Range interpretation must respect ecosystem semantics.</td></tr><tr><td align="right">8</td><td><strong>Fixed version</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/advisories">github.com/advisories</a>, <a href="https://osv.dev/">osv.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Remediation target.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Distro fixed versions may differ due to backports.</td></tr><tr><td align="right">9</td><td><strong>Introduced version / commit</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://ossf.github.io/osv-schema/">ossf.github.io/osv-schema</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open-source</td><td><strong><code>Relevance</code>:</strong> Determines when vulnerability entered codebase.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Not always available.</td></tr><tr><td align="right">10</td><td><strong>Last affected version</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://ossf.github.io/osv-schema/">ossf.github.io/osv-schema</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open-source</td><td><strong><code>Relevance</code>:</strong> Helps determine affected version bounds.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Validate with vendor feeds.</td></tr><tr><td align="right">11</td><td><strong>Backport status</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://access.redhat.com/security/data">access.redhat.com/security/data</a>, <a href="https://security-tracker.debian.org/">security-tracker.debian.org</a>, <a href="https://ubuntu.com/security/cves">ubuntu.com/security/cves</a><br><br><strong><code>Access / Cost</code>:</strong> Mostly free public; some Red Hat support details may require subscription</td><td><strong><code>Relevance</code>:</strong> Determines if a distro package is patched despite upstream version appearing vulnerable.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Essential for reducing false positives.</td></tr><tr><td align="right">12</td><td><strong>VEX status</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/openvex/spec">github.com/openvex/spec</a>, <a href="https://www.csaf.io/">www.csaf.io</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source standards</td><td><strong><code>Relevance</code>:</strong> Represents affected, not affected, fixed, or under investigation.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Preserve justification &#x26; author provenance.</td></tr><tr><td align="right">13</td><td><strong>Justification for not affected</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/openvex/spec">github.com/openvex/spec</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Explains why a product is not affected.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Key for trust &#x26; auditability.</td></tr><tr><td align="right">14</td><td><strong>Distro/package release channel</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://packages.fedoraproject.org/">packages.fedoraproject.org</a>, <a href="https://pkgs.alpinelinux.org/packages">pkgs.alpinelinux.org/packages</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Tracks package release stream.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Channel differences can affect fix availability.</td></tr></tbody></table>

## 6.3 Severity & exploitability

<table><thead><tr><th width="93.3515625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>CVSS v2/v3/v4 vector</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.first.org/cvss/">www.first.org/cvss</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Structured severity vector.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use vector, not only numeric score.</td></tr><tr><td align="right">2</td><td><strong>CVSS base/temporal/environmental score</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://nvd.nist.gov/vuln-metrics/cvss">nvd.nist.gov/vuln-metrics/cvss</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Severity scoring.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Environmental score should be computed with local context.</td></tr><tr><td align="right">3</td><td><strong>EPSS score</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.first.org/epss/">www.first.org/epss</a><br><br><strong><code>Access / Cost</code>:</strong> Free public data/API</td><td><strong><code>Relevance</code>:</strong> Exploit likelihood.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Temporal; store score date.</td></tr><tr><td align="right">4</td><td><strong>EPSS percentile</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.first.org/epss/data_stats">www.first.org/epss/data_stats</a><br><br><strong><code>Access / Cost</code>:</strong> Free public data downloads</td><td><strong><code>Relevance</code>:</strong> Relative exploit-likelihood ranking.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for prioritization across backlog.</td></tr><tr><td align="right">5</td><td><strong>KEV membership</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json">www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json</a><br><br><strong><code>Access / Cost</code>:</strong> Free public feed</td><td><strong><code>Relevance</code>:</strong> Known exploited vulnerability marker.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Strong exploitation evidence.</td></tr><tr><td align="right">6</td><td><strong>KEV date added</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json">www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json</a><br><br><strong><code>Access / Cost</code>:</strong> Free public feed</td><td><strong><code>Relevance</code>:</strong> Temporal exploitation/prioritization signal.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use for SLA &#x26; trend analysis.</td></tr><tr><td align="right">7</td><td><strong>Known ransomware usage</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.ransomware.live/">www.ransomware.live</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Ransomware exploitation context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Attribution &#x26; mapping quality vary.</td></tr><tr><td align="right">8</td><td><strong>Public exploit available</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.exploit-db.com/">www.exploit-db.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> PoC/exploit availability.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Verify reliability &#x26; version applicability.</td></tr><tr><td align="right">9</td><td><strong>Metasploit module available</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits">github.com/rapid7/metasploit-framework/tree/master/modules/exploits</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Weaponized exploit implementation.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Stronger than generic PoC signal.</td></tr><tr><td align="right">10</td><td><strong>Nuclei template available</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/projectdiscovery/nuclei-templates">github.com/projectdiscovery/nuclei-templates</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Detection template availability.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Indicates detectable exposure, not confirmed vulnerability.</td></tr><tr><td align="right">11</td><td><strong>GreyNoise observed scanning</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://viz.greynoise.io/">viz.greynoise.io</a><br><br><strong><code>Access / Cost</code>:</strong> Free tier / paid plans</td><td><strong><code>Relevance</code>:</strong> Internet scanning/exploitation telemetry.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Helps prioritize exposed services.</td></tr><tr><td align="right">12</td><td><strong>Shadowserver observed exposure</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://dashboard.shadowserver.org/">dashboard.shadowserver.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free for eligible organizations; registration may be required</td><td><strong><code>Relevance</code>:</strong> Internet-scale exposure telemetry.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Access may require registration/eligibility.</td></tr><tr><td align="right">13</td><td><strong>CISA SSVC decision points</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/cisagov/vulnrichment">github.com/cisagov/vulnrichment</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Decision support enrichment.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for prioritization workflows.</td></tr><tr><td align="right">14</td><td><strong>Vendor exploitation status</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://msrc.microsoft.com/update-guide">msrc.microsoft.com/update-guide</a>, <a href="https://security.paloaltonetworks.com/">security.paloaltonetworks.com</a>, <a href="https://support.apple.com/en-us/100100">support.apple.com/en-us/100100</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Vendor-provided exploitation notes.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Time-sensitive &#x26; product-specific.</td></tr><tr><td align="right">15</td><td><strong>Patch availability</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://access.redhat.com/security/data">access.redhat.com/security/data</a>, <a href="https://security-tracker.debian.org/">security-tracker.debian.org</a>, <a href="https://ubuntu.com/security/notices">ubuntu.com/security/notices</a><br><br><strong><code>Access / Cost</code>:</strong> Mostly free public; some vendor support details may require subscription</td><td><strong><code>Relevance</code>:</strong> Determines if a fix exists.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Patch availability varies by release stream.</td></tr><tr><td align="right">16</td><td><strong>Workaround availability</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cisa.gov/cybersecurity-advisories">www.cisa.gov/cybersecurity-advisories</a>, <a href="https://www.kb.cert.org/vuls/">www.kb.cert.org/vuls</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Temporary mitigation when patching is not available.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Workarounds may reduce but not eliminate risk.</td></tr></tbody></table>

## 6.4 Environmental impact

<table><thead><tr><th width="90.2265625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td>Asset criticality</td><td><a href="https://www.cisecurity.org/controls">www.cisecurity.org/controls</a></td></tr><tr><td align="right">2</td><td>Internet exposure</td><td><a href="https://search.censys.io/">search.censys.io</a>, <a href="https://www.shodan.io/">www.shodan.io</a></td></tr><tr><td align="right">3</td><td>Network reachability</td><td><a href="https://nmap.org/">nmap.org</a></td></tr><tr><td align="right">4</td><td>Authentication required</td><td><a href="https://www.first.org/cvss/">www.first.org/cvss</a></td></tr><tr><td align="right">5</td><td>Privilege required</td><td><a href="https://www.first.org/cvss/">www.first.org/cvss</a></td></tr><tr><td align="right">6</td><td>User interaction required</td><td><a href="https://www.first.org/cvss/">www.first.org/cvss</a></td></tr><tr><td align="right">7</td><td>Exploit preconditions</td><td><a href="https://projectzero.google/">projectzero.google</a>, <a href="https://www.kb.cert.org/vuls/">www.kb.cert.org/vuls</a></td></tr><tr><td align="right">8</td><td>Data sensitivity</td><td><a href="https://www.cisecurity.org/controls">www.cisecurity.org/controls</a></td></tr><tr><td align="right">9</td><td>Compensating controls</td><td><a href="https://public.cyber.mil/stigs/">public.cyber.mil/stigs</a>, <a href="https://www.cisecurity.org/cis-benchmarks">www.cisecurity.org/cis- benchmarks</a></td></tr><tr><td align="right">10</td><td>Runtime configuration</td><td><a href="https://docs.dependencytrack.org/datasources/overview/">docs.dependencytrack.org/datasources/overview</a></td></tr><tr><td align="right">11</td><td>Feature/module enabled</td><td><a href="https://github.com/openvex/spec">github.com/openvex/spec</a></td></tr><tr><td align="right">12</td><td>Cloud account/project/environment</td><td><a href="https://github.com/prowler-cloud/prowler">github.com/prowler-cloud/prowler</a></td></tr><tr><td align="right">13</td><td>Blast radius</td><td><a href="https://github.com/salesforce/cloudsplaining">github.com/salesforce/cloudsplaining</a></td></tr><tr><td align="right">14</td><td>Business process ownership</td><td><a href="https://www.cisecurity.org/controls">www.cisecurity.org/controls</a></td></tr></tbody></table>

## 6.5 Detection & remediation

<table><thead><tr><th width="93.24609375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Scanner finding ID</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://dependencytrack.org/">dependencytrack.org</a>, <a href="https://github.com/anchore/grype">github.com/anchore/grype</a>, <a href="https://trivy.dev/docs/latest/scanner/vulnerability/">trivy.dev/docs/latest/scanner/vulnerability</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source core tools; commercial support/products may exist</td><td><strong><code>Relevance</code>:</strong> Scanner-specific finding identity.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Preserve source scanner &#x26; version for reproducibility.</td></tr><tr><td align="right">2</td><td><strong>Detection method</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://codeql.github.com/">codeql.github.com</a>, <a href="https://github.com/projectdiscovery/nuclei">github.com/projectdiscovery/nuclei</a>, <a href="https://owasp.org/www-project-top-ten/">owasp.org/www-project-top-ten</a><br><br><strong><code>Access / Cost</code>:</strong> Mixed: free/open-source, with some commercial tiers</td><td><strong><code>Relevance</code>:</strong> Indicates whether finding came from SBOM, CPE, package manager, SAST, DAST, IaC, or runtime telemetry.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Different methods have different false-positive characteristics.</td></tr><tr><td align="right">3</td><td><strong>Confidence</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/openvex/spec">github.com/openvex/spec</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Confidence helps rank findings.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use evidence &#x26; source provenance to compute confidence.</td></tr><tr><td align="right">4</td><td><strong>False-positive reason</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/openvex/spec">github.com/openvex/spec</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Captures why a match is not actually exploitable or affected.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> VEX justification is key for auditability.</td></tr><tr><td align="right">5</td><td><strong>Fix version</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/advisories">github.com/advisories</a>, <a href="https://osv.dev/">osv.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Remediation target version.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Distro fixed versions may differ due to backports.</td></tr><tr><td align="right">6</td><td><strong>Patch advisory</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://access.redhat.com/security/data">access.redhat.com/security/data</a>, <a href="https://ubuntu.com/security/notices">ubuntu.com/security/notices</a>, <a href="https://www.debian.org/security/">www.debian.org/security</a><br><br><strong><code>Access / Cost</code>:</strong> Mostly free public; some Red Hat support details may require subscription</td><td><strong><code>Relevance</code>:</strong> Links vulnerability to vendor patch guidance.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use vendor patch source for production remediation.</td></tr><tr><td align="right">7</td><td><strong>Mitigation</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cisa.gov/cybersecurity-advisories">www.cisa.gov/cybersecurity-advisories</a>, <a href="https://www.kb.cert.org/vuls/">www.kb.cert.org/vuls</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Temporary or compensating controls.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Mitigations may be partial &#x26; context-specific.</td></tr><tr><td align="right">8</td><td><strong>Workaround</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.kb.cert.org/vuls/">www.kb.cert.org/vuls</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Alternative remediation when patch unavailable.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Track expiration &#x26; replacement by patch.</td></tr><tr><td align="right">9</td><td><strong>Exploit detection signatures</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/SigmaHQ/sigma">github.com/SigmaHQ/sigma</a>, <a href="https://github.com/VirusTotal/yara">github.com/VirusTotal/yara</a>, <a href="https://github.com/projectdiscovery/nuclei-templates">github.com/projectdiscovery/nuclei-templates</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repos</td><td><strong><code>Relevance</code>:</strong> Detection content for exploit attempts or compromise.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Validate signatures in environment before high-confidence alerting.</td></tr><tr><td align="right">10</td><td><strong>Regression test</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/google/oss-fuzz">github.com/google/oss-fuzz</a>, <a href="https://google.github.io/oss-fuzz/">google.github.io/oss- fuzz</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source; OSS-Fuzz service for eligible OSS projects</td><td><strong><code>Relevance</code>:</strong> Tests that a vulnerability class or bug does not reappear.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for secure SDLC feedback loops.</td></tr><tr><td align="right">11</td><td><strong>Verification command</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/anchore/grype">github.com/anchore/grype</a>, <a href="https://github.com/aquasecurity/trivy-db">github.com/aquasecurity/trivy-db</a>, <a href="https://github.com/projectdiscovery/nuclei">github.com/projectdiscovery/nuclei</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Command/procedure to verify vulnerability or remediation state.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Required for repeatable remediation closure.</td></tr><tr><td align="right">12</td><td><strong>SLA due date</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities">www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited- vulnerabilities</a>, <a href="https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json">www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Remediation deadline derived from KEV, severity, exposure, policy, or business context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> SLA should be policy-driven &#x26; context- aware.</td></tr></tbody></table>

## Discussion

This chapter section keeps the latest table structure, source titles, access/cost fields, relevance notes, & operational notes from the source inventory. Review the table entries as ingestion candidates, then validate source freshness, licensing, authentication requirements, & link-check behavior before production use.

***

#### [Back to Index](/vulnkeeper/index.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://breachtrace.gitbook.io/vulnkeeper/chapter-b/06-6-recommended-canonical-data-model-coverage.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.