feat(api): Add Policy Registry API specification
Some checks failed
AOC Guard CI / aoc-verify (push) Has been cancelled
AOC Guard CI / aoc-guard (push) Has been cancelled
Docs CI / lint-and-preview (push) Has been cancelled
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
Findings Ledger CI / build-test (push) Has been cancelled
Findings Ledger CI / migration-validation (push) Has been cancelled
Findings Ledger CI / generate-manifest (push) Has been cancelled
mock-dev-release / package-mock-release (push) Has been cancelled
Some checks failed
AOC Guard CI / aoc-verify (push) Has been cancelled
AOC Guard CI / aoc-guard (push) Has been cancelled
Docs CI / lint-and-preview (push) Has been cancelled
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
Findings Ledger CI / build-test (push) Has been cancelled
Findings Ledger CI / migration-validation (push) Has been cancelled
Findings Ledger CI / generate-manifest (push) Has been cancelled
mock-dev-release / package-mock-release (push) Has been cancelled
- Introduced OpenAPI specification for the StellaOps Policy Registry API, covering endpoints for verification policies, policy packs, snapshots, violations, overrides, sealed mode operations, and advisory staleness tracking. - Defined schemas, parameters, and responses for comprehensive API documentation. chore(scanner): Add global usings for scanner analyzers - Created GlobalUsings.cs to simplify namespace usage across analyzer libraries. feat(scanner): Implement Surface Service Collection Extensions - Added SurfaceServiceCollectionExtensions for dependency injection registration of surface analysis services. - Included methods for adding surface analysis, surface collectors, and entry point collectors to the service collection.
This commit is contained in:
StellaOps Bot
502
docs/schemas/export-profiles.schema.json
Normal file
502
docs/schemas/export-profiles.schema.json
Normal file
@@ -0,0 +1,502 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"$id": "https://stella-ops.org/schemas/export-profiles.schema.json",
|
||||
"title": "StellaOps Export Profiles Schema",
|
||||
"description": "Schema for CLI export profiles, scheduling, and distribution configuration. Unblocks CLI-EXPORT-35-001.",
|
||||
"type": "object",
|
||||
"definitions": {
|
||||
"ExportProfile": {
|
||||
"type": "object",
|
||||
"required": ["profile_id", "name", "format", "created_at"],
|
||||
"properties": {
|
||||
"profile_id": {
|
||||
"type": "string",
|
||||
"format": "uuid",
|
||||
"description": "Unique identifier for the export profile"
|
||||
},
|
||||
"name": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"maxLength": 128,
|
||||
"description": "Human-readable profile name"
|
||||
},
|
||||
"description": {
|
||||
"type": "string",
|
||||
"maxLength": 512
|
||||
},
|
||||
"format": {
|
||||
"$ref": "#/definitions/ExportFormat"
|
||||
},
|
||||
"filters": {
|
||||
"$ref": "#/definitions/ExportFilters"
|
||||
},
|
||||
"schedule": {
|
||||
"$ref": "#/definitions/ExportSchedule"
|
||||
},
|
||||
"distribution": {
|
||||
"$ref": "#/definitions/Distribution"
|
||||
},
|
||||
"retention": {
|
||||
"$ref": "#/definitions/RetentionPolicy"
|
||||
},
|
||||
"signing": {
|
||||
"$ref": "#/definitions/SigningConfig"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object",
|
||||
"additionalProperties": true
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"tenant_id": {
|
||||
"type": "string",
|
||||
"format": "uuid"
|
||||
},
|
||||
"created_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"updated_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"created_by": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ExportFormat": {
|
||||
"type": "object",
|
||||
"required": ["type"],
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string",
|
||||
"enum": ["sbom", "vex", "attestation", "evidence", "risk-report", "compliance-report", "airgap-bundle"]
|
||||
},
|
||||
"variant": {
|
||||
"type": "string",
|
||||
"enum": ["cyclonedx-1.6", "spdx-3.0.1", "openvex", "csaf-vex", "in-toto", "dsse", "json", "csv", "pdf"],
|
||||
"description": "Format variant for the export type"
|
||||
},
|
||||
"options": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"include_signatures": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"include_provenance": {
|
||||
"type": "boolean",
|
||||
"default": false
|
||||
},
|
||||
"include_rekor_receipts": {
|
||||
"type": "boolean",
|
||||
"default": false
|
||||
},
|
||||
"compress": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"compression_algorithm": {
|
||||
"type": "string",
|
||||
"enum": ["gzip", "zstd", "none"],
|
||||
"default": "gzip"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"ExportFilters": {
|
||||
"type": "object",
|
||||
"description": "Filters to apply when selecting data for export",
|
||||
"properties": {
|
||||
"date_range": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"from": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"to": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"relative": {
|
||||
"type": "string",
|
||||
"pattern": "^-?[0-9]+[hdwmy]$",
|
||||
"description": "Relative time range (e.g., -7d for last 7 days)"
|
||||
}
|
||||
}
|
||||
},
|
||||
"severity": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"enum": ["critical", "high", "medium", "low", "info", "unknown"]
|
||||
}
|
||||
},
|
||||
"vex_status": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"enum": ["affected", "not_affected", "fixed", "under_investigation"]
|
||||
}
|
||||
},
|
||||
"components": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "PURL patterns to include"
|
||||
},
|
||||
"exclude_components": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "PURL patterns to exclude"
|
||||
},
|
||||
"cve_ids": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"pattern": "^CVE-[0-9]{4}-[0-9]+$"
|
||||
}
|
||||
},
|
||||
"tags": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"environments": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"ExportSchedule": {
|
||||
"type": "object",
|
||||
"description": "Schedule for automated exports",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": false
|
||||
},
|
||||
"cron": {
|
||||
"type": "string",
|
||||
"pattern": "^(@(annually|yearly|monthly|weekly|daily|hourly))|((\\*|[0-9,\\-\\/]+)\\s+){4,5}(\\*|[0-9,\\-\\/]+)$",
|
||||
"description": "Cron expression for scheduling (5 or 6 fields)"
|
||||
},
|
||||
"timezone": {
|
||||
"type": "string",
|
||||
"default": "UTC",
|
||||
"description": "IANA timezone identifier"
|
||||
},
|
||||
"next_run": {
|
||||
"type": "string",
|
||||
"format": "date-time",
|
||||
"readOnly": true
|
||||
},
|
||||
"last_run": {
|
||||
"type": "string",
|
||||
"format": "date-time",
|
||||
"readOnly": true
|
||||
},
|
||||
"last_status": {
|
||||
"type": "string",
|
||||
"enum": ["success", "partial", "failed", "pending"],
|
||||
"readOnly": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"Distribution": {
|
||||
"type": "object",
|
||||
"description": "Distribution targets for exports",
|
||||
"properties": {
|
||||
"targets": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/DistributionTarget"
|
||||
}
|
||||
},
|
||||
"notify_on_completion": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"notify_on_failure": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"DistributionTarget": {
|
||||
"type": "object",
|
||||
"required": ["type"],
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string",
|
||||
"enum": ["s3", "azure-blob", "gcs", "sftp", "webhook", "email", "local"]
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"config": {
|
||||
"type": "object",
|
||||
"description": "Target-specific configuration",
|
||||
"additionalProperties": true
|
||||
}
|
||||
},
|
||||
"allOf": [
|
||||
{
|
||||
"if": {
|
||||
"properties": { "type": { "const": "s3" } }
|
||||
},
|
||||
"then": {
|
||||
"properties": {
|
||||
"config": {
|
||||
"type": "object",
|
||||
"required": ["bucket", "region"],
|
||||
"properties": {
|
||||
"bucket": { "type": "string" },
|
||||
"region": { "type": "string" },
|
||||
"prefix": { "type": "string" },
|
||||
"credentials_secret": { "type": "string" }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {
|
||||
"properties": { "type": { "const": "webhook" } }
|
||||
},
|
||||
"then": {
|
||||
"properties": {
|
||||
"config": {
|
||||
"type": "object",
|
||||
"required": ["url"],
|
||||
"properties": {
|
||||
"url": { "type": "string", "format": "uri" },
|
||||
"method": { "type": "string", "enum": ["POST", "PUT"], "default": "POST" },
|
||||
"headers": { "type": "object", "additionalProperties": { "type": "string" } },
|
||||
"auth_secret": { "type": "string" }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"RetentionPolicy": {
|
||||
"type": "object",
|
||||
"description": "Retention policy for exported artifacts",
|
||||
"properties": {
|
||||
"max_age_days": {
|
||||
"type": "integer",
|
||||
"minimum": 1,
|
||||
"maximum": 3650,
|
||||
"default": 365
|
||||
},
|
||||
"max_count": {
|
||||
"type": "integer",
|
||||
"minimum": 1,
|
||||
"description": "Maximum number of exports to retain"
|
||||
},
|
||||
"delete_on_success": {
|
||||
"type": "boolean",
|
||||
"default": false,
|
||||
"description": "Delete source data after successful export"
|
||||
}
|
||||
}
|
||||
},
|
||||
"SigningConfig": {
|
||||
"type": "object",
|
||||
"description": "Signing configuration for exports",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"key_id": {
|
||||
"type": "string",
|
||||
"description": "Key identifier for signing"
|
||||
},
|
||||
"algorithm": {
|
||||
"type": "string",
|
||||
"enum": ["ES256", "RS256", "EdDSA"],
|
||||
"default": "ES256"
|
||||
},
|
||||
"include_rekor": {
|
||||
"type": "boolean",
|
||||
"default": false,
|
||||
"description": "Include Rekor transparency log receipt"
|
||||
},
|
||||
"timestamp_authority": {
|
||||
"type": "string",
|
||||
"format": "uri",
|
||||
"description": "RFC 3161 timestamp authority URL"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ExportJob": {
|
||||
"type": "object",
|
||||
"description": "Export job status",
|
||||
"required": ["job_id", "profile_id", "status", "created_at"],
|
||||
"properties": {
|
||||
"job_id": {
|
||||
"type": "string",
|
||||
"format": "uuid"
|
||||
},
|
||||
"profile_id": {
|
||||
"type": "string",
|
||||
"format": "uuid"
|
||||
},
|
||||
"status": {
|
||||
"type": "string",
|
||||
"enum": ["pending", "running", "success", "partial", "failed", "cancelled"]
|
||||
},
|
||||
"progress": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"percent": {
|
||||
"type": "integer",
|
||||
"minimum": 0,
|
||||
"maximum": 100
|
||||
},
|
||||
"items_processed": {
|
||||
"type": "integer"
|
||||
},
|
||||
"items_total": {
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
},
|
||||
"artifacts": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/ExportArtifact"
|
||||
}
|
||||
},
|
||||
"errors": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"created_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"started_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"completed_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ExportArtifact": {
|
||||
"type": "object",
|
||||
"required": ["artifact_id", "digest", "size"],
|
||||
"properties": {
|
||||
"artifact_id": {
|
||||
"type": "string",
|
||||
"format": "uuid"
|
||||
},
|
||||
"filename": {
|
||||
"type": "string"
|
||||
},
|
||||
"digest": {
|
||||
"type": "string",
|
||||
"pattern": "^sha256:[a-f0-9]{64}$"
|
||||
},
|
||||
"size": {
|
||||
"type": "integer",
|
||||
"description": "Size in bytes"
|
||||
},
|
||||
"format": {
|
||||
"type": "string"
|
||||
},
|
||||
"signature": {
|
||||
"type": "string",
|
||||
"description": "Base64-encoded signature"
|
||||
},
|
||||
"download_url": {
|
||||
"type": "string",
|
||||
"format": "uri"
|
||||
},
|
||||
"expires_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"properties": {
|
||||
"profiles": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/ExportProfile"
|
||||
}
|
||||
}
|
||||
},
|
||||
"examples": [
|
||||
{
|
||||
"profiles": [
|
||||
{
|
||||
"profile_id": "550e8400-e29b-41d4-a716-446655440001",
|
||||
"name": "Weekly SBOM Export",
|
||||
"description": "Export all SBOMs in CycloneDX format weekly",
|
||||
"format": {
|
||||
"type": "sbom",
|
||||
"variant": "cyclonedx-1.6",
|
||||
"options": {
|
||||
"include_signatures": true,
|
||||
"compress": true
|
||||
}
|
||||
},
|
||||
"filters": {
|
||||
"date_range": {
|
||||
"relative": "-7d"
|
||||
}
|
||||
},
|
||||
"schedule": {
|
||||
"enabled": true,
|
||||
"cron": "0 2 * * 0",
|
||||
"timezone": "UTC"
|
||||
},
|
||||
"distribution": {
|
||||
"targets": [
|
||||
{
|
||||
"type": "s3",
|
||||
"name": "compliance-bucket",
|
||||
"config": {
|
||||
"bucket": "company-compliance-exports",
|
||||
"region": "us-east-1",
|
||||
"prefix": "sboms/"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"retention": {
|
||||
"max_age_days": 365,
|
||||
"max_count": 52
|
||||
},
|
||||
"enabled": true,
|
||||
"created_at": "2025-12-01T00:00:00Z"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
605
docs/schemas/notify-rules.schema.json
Normal file
605
docs/schemas/notify-rules.schema.json
Normal file
@@ -0,0 +1,605 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"$id": "https://stella-ops.org/schemas/notify-rules.schema.json",
|
||||
"title": "StellaOps Notification Rules Schema",
|
||||
"description": "Schema for notification rules, webhook payloads, and digest formats. Unblocks CLI-NOTIFY-38-001.",
|
||||
"type": "object",
|
||||
"definitions": {
|
||||
"NotifyRule": {
|
||||
"type": "object",
|
||||
"required": ["rule_id", "name", "event_types", "channels", "created_at"],
|
||||
"properties": {
|
||||
"rule_id": {
|
||||
"type": "string",
|
||||
"format": "uuid",
|
||||
"description": "Unique identifier for the notification rule"
|
||||
},
|
||||
"name": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"maxLength": 128,
|
||||
"description": "Human-readable rule name"
|
||||
},
|
||||
"description": {
|
||||
"type": "string",
|
||||
"maxLength": 512
|
||||
},
|
||||
"event_types": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"items": {
|
||||
"$ref": "#/definitions/EventType"
|
||||
},
|
||||
"description": "Event types that trigger this rule"
|
||||
},
|
||||
"filters": {
|
||||
"$ref": "#/definitions/NotifyFilters"
|
||||
},
|
||||
"channels": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"items": {
|
||||
"$ref": "#/definitions/NotifyChannel"
|
||||
}
|
||||
},
|
||||
"throttle": {
|
||||
"$ref": "#/definitions/ThrottleConfig"
|
||||
},
|
||||
"digest": {
|
||||
"$ref": "#/definitions/DigestConfig"
|
||||
},
|
||||
"templates": {
|
||||
"$ref": "#/definitions/NotifyTemplates"
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"priority": {
|
||||
"type": "integer",
|
||||
"minimum": 0,
|
||||
"maximum": 100,
|
||||
"default": 50,
|
||||
"description": "Rule priority (higher = processed first)"
|
||||
},
|
||||
"tenant_id": {
|
||||
"type": "string",
|
||||
"format": "uuid"
|
||||
},
|
||||
"created_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"updated_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"created_by": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"EventType": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"vulnerability.new",
|
||||
"vulnerability.updated",
|
||||
"vulnerability.resolved",
|
||||
"vulnerability.critical",
|
||||
"vex.status_changed",
|
||||
"vex.consensus_changed",
|
||||
"policy.violation",
|
||||
"policy.override_requested",
|
||||
"policy.override_approved",
|
||||
"policy.override_expired",
|
||||
"scan.completed",
|
||||
"scan.failed",
|
||||
"attestation.created",
|
||||
"attestation.verification_failed",
|
||||
"airgap.staleness_warning",
|
||||
"airgap.staleness_critical",
|
||||
"airgap.bundle_imported",
|
||||
"export.completed",
|
||||
"export.failed",
|
||||
"system.health_degraded",
|
||||
"system.error"
|
||||
]
|
||||
},
|
||||
"NotifyFilters": {
|
||||
"type": "object",
|
||||
"description": "Filters to apply before triggering notification",
|
||||
"properties": {
|
||||
"severity": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"enum": ["critical", "high", "medium", "low", "info"]
|
||||
},
|
||||
"description": "Only trigger for these severities"
|
||||
},
|
||||
"cvss_minimum": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 10,
|
||||
"description": "Minimum CVSS score to trigger"
|
||||
},
|
||||
"components": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "PURL patterns to match"
|
||||
},
|
||||
"environments": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"tags": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"kev_only": {
|
||||
"type": "boolean",
|
||||
"default": false,
|
||||
"description": "Only trigger for Known Exploited Vulnerabilities"
|
||||
},
|
||||
"fix_available": {
|
||||
"type": "boolean",
|
||||
"description": "Filter by fix availability"
|
||||
}
|
||||
}
|
||||
},
|
||||
"NotifyChannel": {
|
||||
"type": "object",
|
||||
"required": ["type"],
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string",
|
||||
"enum": ["email", "slack", "teams", "webhook", "pagerduty", "opsgenie", "sns"]
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"config": {
|
||||
"type": "object",
|
||||
"additionalProperties": true
|
||||
}
|
||||
},
|
||||
"allOf": [
|
||||
{
|
||||
"if": { "properties": { "type": { "const": "email" } } },
|
||||
"then": {
|
||||
"properties": {
|
||||
"config": {
|
||||
"type": "object",
|
||||
"required": ["recipients"],
|
||||
"properties": {
|
||||
"recipients": {
|
||||
"type": "array",
|
||||
"items": { "type": "string", "format": "email" }
|
||||
},
|
||||
"cc": {
|
||||
"type": "array",
|
||||
"items": { "type": "string", "format": "email" }
|
||||
},
|
||||
"subject_prefix": { "type": "string" }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": { "properties": { "type": { "const": "slack" } } },
|
||||
"then": {
|
||||
"properties": {
|
||||
"config": {
|
||||
"type": "object",
|
||||
"required": ["webhook_url"],
|
||||
"properties": {
|
||||
"webhook_url": { "type": "string", "format": "uri" },
|
||||
"channel": { "type": "string" },
|
||||
"username": { "type": "string" },
|
||||
"icon_emoji": { "type": "string" }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": { "properties": { "type": { "const": "teams" } } },
|
||||
"then": {
|
||||
"properties": {
|
||||
"config": {
|
||||
"type": "object",
|
||||
"required": ["webhook_url"],
|
||||
"properties": {
|
||||
"webhook_url": { "type": "string", "format": "uri" }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": { "properties": { "type": { "const": "webhook" } } },
|
||||
"then": {
|
||||
"properties": {
|
||||
"config": {
|
||||
"type": "object",
|
||||
"required": ["url"],
|
||||
"properties": {
|
||||
"url": { "type": "string", "format": "uri" },
|
||||
"method": { "type": "string", "enum": ["POST", "PUT"], "default": "POST" },
|
||||
"headers": { "type": "object", "additionalProperties": { "type": "string" } },
|
||||
"auth_type": { "type": "string", "enum": ["none", "basic", "bearer", "hmac"] },
|
||||
"auth_secret": { "type": "string" },
|
||||
"retry_count": { "type": "integer", "minimum": 0, "maximum": 5, "default": 3 },
|
||||
"timeout_seconds": { "type": "integer", "minimum": 1, "maximum": 60, "default": 30 }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": { "properties": { "type": { "const": "pagerduty" } } },
|
||||
"then": {
|
||||
"properties": {
|
||||
"config": {
|
||||
"type": "object",
|
||||
"required": ["routing_key"],
|
||||
"properties": {
|
||||
"routing_key": { "type": "string" },
|
||||
"severity_mapping": {
|
||||
"type": "object",
|
||||
"additionalProperties": { "type": "string", "enum": ["critical", "error", "warning", "info"] }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"ThrottleConfig": {
|
||||
"type": "object",
|
||||
"description": "Throttling configuration to prevent notification storms",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"max_per_hour": {
|
||||
"type": "integer",
|
||||
"minimum": 1,
|
||||
"default": 100
|
||||
},
|
||||
"max_per_day": {
|
||||
"type": "integer",
|
||||
"minimum": 1,
|
||||
"default": 1000
|
||||
},
|
||||
"dedupe_window_seconds": {
|
||||
"type": "integer",
|
||||
"minimum": 0,
|
||||
"default": 300,
|
||||
"description": "Window for deduplicating identical notifications"
|
||||
},
|
||||
"dedupe_key_fields": {
|
||||
"type": "array",
|
||||
"items": { "type": "string" },
|
||||
"default": ["event_type", "cve_id", "purl"],
|
||||
"description": "Fields to use for deduplication key"
|
||||
}
|
||||
}
|
||||
},
|
||||
"DigestConfig": {
|
||||
"type": "object",
|
||||
"description": "Configuration for digest/summary notifications",
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"default": false
|
||||
},
|
||||
"frequency": {
|
||||
"type": "string",
|
||||
"enum": ["hourly", "daily", "weekly"],
|
||||
"default": "daily"
|
||||
},
|
||||
"schedule": {
|
||||
"type": "string",
|
||||
"description": "Cron expression for digest delivery"
|
||||
},
|
||||
"timezone": {
|
||||
"type": "string",
|
||||
"default": "UTC"
|
||||
},
|
||||
"min_events": {
|
||||
"type": "integer",
|
||||
"minimum": 1,
|
||||
"default": 1,
|
||||
"description": "Minimum events required to send digest"
|
||||
},
|
||||
"group_by": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"enum": ["severity", "event_type", "component", "environment"]
|
||||
},
|
||||
"description": "Fields to group events by in digest"
|
||||
},
|
||||
"include_summary": {
|
||||
"type": "boolean",
|
||||
"default": true
|
||||
},
|
||||
"include_details": {
|
||||
"type": "boolean",
|
||||
"default": false,
|
||||
"description": "Include full event details in digest"
|
||||
}
|
||||
}
|
||||
},
|
||||
"NotifyTemplates": {
|
||||
"type": "object",
|
||||
"description": "Custom notification templates",
|
||||
"properties": {
|
||||
"subject": {
|
||||
"type": "string",
|
||||
"description": "Template for notification subject (supports {{variables}})"
|
||||
},
|
||||
"body": {
|
||||
"type": "string",
|
||||
"description": "Template for notification body"
|
||||
},
|
||||
"body_html": {
|
||||
"type": "string",
|
||||
"description": "HTML template for email body"
|
||||
}
|
||||
}
|
||||
},
|
||||
"WebhookPayload": {
|
||||
"type": "object",
|
||||
"description": "Standard webhook payload format",
|
||||
"required": ["id", "timestamp", "event_type", "data"],
|
||||
"properties": {
|
||||
"id": {
|
||||
"type": "string",
|
||||
"format": "uuid",
|
||||
"description": "Unique notification ID"
|
||||
},
|
||||
"timestamp": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"event_type": {
|
||||
"$ref": "#/definitions/EventType"
|
||||
},
|
||||
"version": {
|
||||
"type": "string",
|
||||
"default": "1.0.0"
|
||||
},
|
||||
"tenant_id": {
|
||||
"type": "string",
|
||||
"format": "uuid"
|
||||
},
|
||||
"data": {
|
||||
"type": "object",
|
||||
"description": "Event-specific payload data",
|
||||
"additionalProperties": true
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"rule_id": { "type": "string", "format": "uuid" },
|
||||
"rule_name": { "type": "string" },
|
||||
"retry_count": { "type": "integer" },
|
||||
"digest_id": { "type": "string", "format": "uuid" }
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"DigestPayload": {
|
||||
"type": "object",
|
||||
"description": "Digest/summary notification payload",
|
||||
"required": ["id", "timestamp", "period", "summary"],
|
||||
"properties": {
|
||||
"id": {
|
||||
"type": "string",
|
||||
"format": "uuid"
|
||||
},
|
||||
"timestamp": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"period": {
|
||||
"type": "object",
|
||||
"required": ["start", "end"],
|
||||
"properties": {
|
||||
"start": { "type": "string", "format": "date-time" },
|
||||
"end": { "type": "string", "format": "date-time" }
|
||||
}
|
||||
},
|
||||
"summary": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"total_events": { "type": "integer" },
|
||||
"by_severity": {
|
||||
"type": "object",
|
||||
"additionalProperties": { "type": "integer" }
|
||||
},
|
||||
"by_event_type": {
|
||||
"type": "object",
|
||||
"additionalProperties": { "type": "integer" }
|
||||
},
|
||||
"new_vulnerabilities": { "type": "integer" },
|
||||
"resolved_vulnerabilities": { "type": "integer" },
|
||||
"policy_violations": { "type": "integer" }
|
||||
}
|
||||
},
|
||||
"events": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/WebhookPayload"
|
||||
},
|
||||
"description": "Optional detailed event list"
|
||||
},
|
||||
"groups": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"key": { "type": "string" },
|
||||
"count": { "type": "integer" },
|
||||
"sample_events": {
|
||||
"type": "array",
|
||||
"items": { "$ref": "#/definitions/WebhookPayload" }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"NotifySimulationRequest": {
|
||||
"type": "object",
|
||||
"description": "Request to simulate a notification rule",
|
||||
"required": ["event"],
|
||||
"properties": {
|
||||
"rule_id": {
|
||||
"type": "string",
|
||||
"format": "uuid",
|
||||
"description": "Rule to simulate (optional, uses all matching if not specified)"
|
||||
},
|
||||
"event": {
|
||||
"$ref": "#/definitions/WebhookPayload"
|
||||
},
|
||||
"dry_run": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "If true, don't actually send notifications"
|
||||
}
|
||||
}
|
||||
},
|
||||
"NotifySimulationResult": {
|
||||
"type": "object",
|
||||
"required": ["matched_rules", "would_notify"],
|
||||
"properties": {
|
||||
"matched_rules": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"rule_id": { "type": "string", "format": "uuid" },
|
||||
"rule_name": { "type": "string" },
|
||||
"matched": { "type": "boolean" },
|
||||
"reason": { "type": "string" }
|
||||
}
|
||||
}
|
||||
},
|
||||
"would_notify": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"channel_type": { "type": "string" },
|
||||
"channel_name": { "type": "string" },
|
||||
"payload_preview": { "type": "object" }
|
||||
}
|
||||
}
|
||||
},
|
||||
"throttled": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"throttle_reason": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"NotifyAckToken": {
|
||||
"type": "object",
|
||||
"description": "Acknowledgement token for notifications",
|
||||
"required": ["token", "notification_id", "expires_at"],
|
||||
"properties": {
|
||||
"token": {
|
||||
"type": "string",
|
||||
"description": "Opaque acknowledgement token"
|
||||
},
|
||||
"notification_id": {
|
||||
"type": "string",
|
||||
"format": "uuid"
|
||||
},
|
||||
"event_type": {
|
||||
"$ref": "#/definitions/EventType"
|
||||
},
|
||||
"expires_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"ack_url": {
|
||||
"type": "string",
|
||||
"format": "uri",
|
||||
"description": "URL to acknowledge the notification"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"properties": {
|
||||
"rules": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/NotifyRule"
|
||||
}
|
||||
}
|
||||
},
|
||||
"examples": [
|
||||
{
|
||||
"rules": [
|
||||
{
|
||||
"rule_id": "550e8400-e29b-41d4-a716-446655440002",
|
||||
"name": "Critical Vulnerability Alert",
|
||||
"description": "Immediate notification for critical vulnerabilities",
|
||||
"event_types": ["vulnerability.critical", "vulnerability.new"],
|
||||
"filters": {
|
||||
"severity": ["critical"],
|
||||
"kev_only": false
|
||||
},
|
||||
"channels": [
|
||||
{
|
||||
"type": "slack",
|
||||
"name": "security-alerts",
|
||||
"config": {
|
||||
"webhook_url": "https://hooks.slack.com/services/xxx",
|
||||
"channel": "#security-alerts",
|
||||
"icon_emoji": ":warning:"
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "pagerduty",
|
||||
"name": "security-oncall",
|
||||
"config": {
|
||||
"routing_key": "xxx",
|
||||
"severity_mapping": {
|
||||
"critical": "critical",
|
||||
"high": "error"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"throttle": {
|
||||
"enabled": true,
|
||||
"max_per_hour": 50,
|
||||
"dedupe_window_seconds": 300
|
||||
},
|
||||
"enabled": true,
|
||||
"priority": 100,
|
||||
"created_at": "2025-12-01T00:00:00Z"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
1510
docs/schemas/policy-registry-api.openapi.yaml
Normal file
1510
docs/schemas/policy-registry-api.openapi.yaml
Normal file
File diff suppressed because it is too large
Load Diff
564
docs/schemas/reachability-input.schema.json
Normal file
564
docs/schemas/reachability-input.schema.json
Normal file
@@ -0,0 +1,564 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"$id": "https://stella-ops.org/schemas/reachability-input.schema.json",
|
||||
"title": "StellaOps Reachability Input Schema",
|
||||
"description": "Schema for reachability/exploitability signals input to Policy Engine. Unblocks POLICY-ENGINE-80-001, POLICY-RISK-66-003.",
|
||||
"type": "object",
|
||||
"definitions": {
|
||||
"ReachabilityInput": {
|
||||
"type": "object",
|
||||
"description": "Input payload for policy engine reachability evaluation",
|
||||
"required": ["subject", "reachability_facts", "timestamp"],
|
||||
"properties": {
|
||||
"subject": {
|
||||
"$ref": "#/definitions/Subject"
|
||||
},
|
||||
"reachability_facts": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/ReachabilityFact"
|
||||
}
|
||||
},
|
||||
"exploitability_facts": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/ExploitabilityFact"
|
||||
}
|
||||
},
|
||||
"callgraph_refs": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/CallgraphRef"
|
||||
}
|
||||
},
|
||||
"runtime_facts": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/RuntimeFact"
|
||||
}
|
||||
},
|
||||
"entropy_score": {
|
||||
"$ref": "#/definitions/EntropyScore"
|
||||
},
|
||||
"timestamp": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object",
|
||||
"additionalProperties": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"Subject": {
|
||||
"type": "object",
|
||||
"description": "Subject being evaluated (component + vulnerability)",
|
||||
"required": ["purl"],
|
||||
"properties": {
|
||||
"purl": {
|
||||
"type": "string",
|
||||
"description": "Package URL of the component"
|
||||
},
|
||||
"cve_id": {
|
||||
"type": "string",
|
||||
"pattern": "^CVE-[0-9]{4}-[0-9]+$"
|
||||
},
|
||||
"ghsa_id": {
|
||||
"type": "string",
|
||||
"pattern": "^GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$"
|
||||
},
|
||||
"vulnerability_id": {
|
||||
"type": "string",
|
||||
"description": "Internal vulnerability identifier"
|
||||
},
|
||||
"affected_symbols": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Vulnerable symbols/functions in the component"
|
||||
},
|
||||
"version_range": {
|
||||
"type": "string",
|
||||
"description": "Affected version range (e.g., '<1.2.3')"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ReachabilityFact": {
|
||||
"type": "object",
|
||||
"description": "Static reachability analysis result",
|
||||
"required": ["state", "confidence"],
|
||||
"properties": {
|
||||
"state": {
|
||||
"type": "string",
|
||||
"enum": ["reachable", "unreachable", "potentially_reachable", "unknown"],
|
||||
"description": "Reachability state"
|
||||
},
|
||||
"confidence": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 1,
|
||||
"description": "Confidence score (0-1)"
|
||||
},
|
||||
"source": {
|
||||
"type": "string",
|
||||
"enum": ["static_analysis", "dynamic_analysis", "sbom_inference", "manual", "external"],
|
||||
"description": "Source of the reachability determination"
|
||||
},
|
||||
"analyzer": {
|
||||
"type": "string",
|
||||
"description": "Analyzer tool that produced this fact"
|
||||
},
|
||||
"analyzer_version": {
|
||||
"type": "string"
|
||||
},
|
||||
"call_path": {
|
||||
"$ref": "#/definitions/CallPath"
|
||||
},
|
||||
"entry_points": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/EntryPoint"
|
||||
}
|
||||
},
|
||||
"evidence": {
|
||||
"$ref": "#/definitions/ReachabilityEvidence"
|
||||
},
|
||||
"evaluated_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
}
|
||||
}
|
||||
},
|
||||
"CallPath": {
|
||||
"type": "object",
|
||||
"description": "Call path from entry point to vulnerable symbol",
|
||||
"properties": {
|
||||
"depth": {
|
||||
"type": "integer",
|
||||
"minimum": 0,
|
||||
"description": "Call depth from entry point"
|
||||
},
|
||||
"nodes": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/CallNode"
|
||||
}
|
||||
},
|
||||
"edges": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/CallEdge"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"CallNode": {
|
||||
"type": "object",
|
||||
"required": ["id", "symbol"],
|
||||
"properties": {
|
||||
"id": {
|
||||
"type": "string"
|
||||
},
|
||||
"symbol": {
|
||||
"type": "string",
|
||||
"description": "Fully qualified symbol name"
|
||||
},
|
||||
"file": {
|
||||
"type": "string"
|
||||
},
|
||||
"line": {
|
||||
"type": "integer"
|
||||
},
|
||||
"package": {
|
||||
"type": "string"
|
||||
},
|
||||
"is_vulnerable": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"is_entry_point": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"CallEdge": {
|
||||
"type": "object",
|
||||
"required": ["source", "target"],
|
||||
"properties": {
|
||||
"source": {
|
||||
"type": "string"
|
||||
},
|
||||
"target": {
|
||||
"type": "string"
|
||||
},
|
||||
"call_type": {
|
||||
"type": "string",
|
||||
"enum": ["direct", "indirect", "virtual", "reflection", "dynamic"]
|
||||
}
|
||||
}
|
||||
},
|
||||
"EntryPoint": {
|
||||
"type": "object",
|
||||
"description": "Application entry point that can reach vulnerable code",
|
||||
"required": ["type", "identifier"],
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string",
|
||||
"enum": ["http_endpoint", "grpc_method", "cli_command", "event_handler", "scheduled_job", "main", "test"]
|
||||
},
|
||||
"identifier": {
|
||||
"type": "string",
|
||||
"description": "Entry point identifier (e.g., 'POST /api/users')"
|
||||
},
|
||||
"file": {
|
||||
"type": "string"
|
||||
},
|
||||
"line": {
|
||||
"type": "integer"
|
||||
},
|
||||
"exposed": {
|
||||
"type": "boolean",
|
||||
"default": true,
|
||||
"description": "Whether this entry point is externally exposed"
|
||||
},
|
||||
"authentication_required": {
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ReachabilityEvidence": {
|
||||
"type": "object",
|
||||
"description": "Supporting evidence for reachability determination",
|
||||
"properties": {
|
||||
"digest": {
|
||||
"type": "string",
|
||||
"pattern": "^sha256:[a-f0-9]{64}$"
|
||||
},
|
||||
"evidence_uri": {
|
||||
"type": "string",
|
||||
"format": "uri"
|
||||
},
|
||||
"callgraph_digest": {
|
||||
"type": "string"
|
||||
},
|
||||
"sbom_digest": {
|
||||
"type": "string"
|
||||
},
|
||||
"analysis_log_uri": {
|
||||
"type": "string",
|
||||
"format": "uri"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ExploitabilityFact": {
|
||||
"type": "object",
|
||||
"description": "Exploitability assessment",
|
||||
"required": ["state", "confidence"],
|
||||
"properties": {
|
||||
"state": {
|
||||
"type": "string",
|
||||
"enum": ["exploitable", "not_exploitable", "conditionally_exploitable", "unknown"]
|
||||
},
|
||||
"confidence": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 1
|
||||
},
|
||||
"source": {
|
||||
"type": "string",
|
||||
"enum": ["kev", "epss", "vendor_advisory", "internal_analysis", "exploit_db"]
|
||||
},
|
||||
"epss_score": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 1,
|
||||
"description": "EPSS probability score"
|
||||
},
|
||||
"epss_percentile": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 100
|
||||
},
|
||||
"kev_listed": {
|
||||
"type": "boolean",
|
||||
"description": "Listed in CISA Known Exploited Vulnerabilities"
|
||||
},
|
||||
"kev_due_date": {
|
||||
"type": "string",
|
||||
"format": "date"
|
||||
},
|
||||
"exploit_maturity": {
|
||||
"type": "string",
|
||||
"enum": ["not_defined", "unproven", "poc", "functional", "high"],
|
||||
"description": "Exploit maturity level (per CVSS)"
|
||||
},
|
||||
"exploit_refs": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "uri"
|
||||
}
|
||||
},
|
||||
"conditions": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/ExploitCondition"
|
||||
},
|
||||
"description": "Conditions required for exploitation"
|
||||
},
|
||||
"evaluated_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ExploitCondition": {
|
||||
"type": "object",
|
||||
"description": "Condition required for exploitation",
|
||||
"required": ["condition", "met"],
|
||||
"properties": {
|
||||
"condition": {
|
||||
"type": "string",
|
||||
"description": "Description of the condition"
|
||||
},
|
||||
"met": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"confidence": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 1
|
||||
},
|
||||
"evidence": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"CallgraphRef": {
|
||||
"type": "object",
|
||||
"description": "Reference to a stored callgraph",
|
||||
"required": ["digest"],
|
||||
"properties": {
|
||||
"digest": {
|
||||
"type": "string",
|
||||
"pattern": "^sha256:[a-f0-9]{64}$"
|
||||
},
|
||||
"format": {
|
||||
"type": "string",
|
||||
"enum": ["richgraph-v1", "dot", "json-graph", "sarif"],
|
||||
"default": "richgraph-v1"
|
||||
},
|
||||
"uri": {
|
||||
"type": "string",
|
||||
"format": "uri"
|
||||
},
|
||||
"generated_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"generator": {
|
||||
"type": "string"
|
||||
},
|
||||
"generator_version": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"RuntimeFact": {
|
||||
"type": "object",
|
||||
"description": "Runtime observation fact",
|
||||
"required": ["type", "observed_at"],
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string",
|
||||
"enum": ["function_called", "function_not_called", "path_executed", "path_not_executed", "module_loaded", "module_not_loaded"]
|
||||
},
|
||||
"symbol": {
|
||||
"type": "string"
|
||||
},
|
||||
"module": {
|
||||
"type": "string"
|
||||
},
|
||||
"call_count": {
|
||||
"type": "integer",
|
||||
"minimum": 0
|
||||
},
|
||||
"last_called": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"observed_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
},
|
||||
"observation_window": {
|
||||
"type": "string",
|
||||
"description": "Duration of observation (e.g., '7d', '30d')"
|
||||
},
|
||||
"environment": {
|
||||
"type": "string",
|
||||
"enum": ["production", "staging", "development", "test"]
|
||||
}
|
||||
}
|
||||
},
|
||||
"EntropyScore": {
|
||||
"type": "object",
|
||||
"description": "Scanner entropy/trust score for confidence weighting",
|
||||
"properties": {
|
||||
"overall": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 1,
|
||||
"description": "Overall trust score"
|
||||
},
|
||||
"sbom_completeness": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 1
|
||||
},
|
||||
"callgraph_coverage": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 1
|
||||
},
|
||||
"runtime_coverage": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 1
|
||||
},
|
||||
"analyzer_confidence": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 1
|
||||
},
|
||||
"data_freshness": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 1,
|
||||
"description": "How recent the underlying data is"
|
||||
}
|
||||
}
|
||||
},
|
||||
"ReachabilityOutput": {
|
||||
"type": "object",
|
||||
"description": "Policy engine output after reachability evaluation",
|
||||
"required": ["subject", "effective_state", "risk_adjustment"],
|
||||
"properties": {
|
||||
"subject": {
|
||||
"$ref": "#/definitions/Subject"
|
||||
},
|
||||
"effective_state": {
|
||||
"type": "string",
|
||||
"enum": ["reachable", "unreachable", "potentially_reachable", "unknown"]
|
||||
},
|
||||
"effective_exploitability": {
|
||||
"type": "string",
|
||||
"enum": ["exploitable", "not_exploitable", "conditionally_exploitable", "unknown"]
|
||||
},
|
||||
"risk_adjustment": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"factor": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 2,
|
||||
"description": "Risk multiplier (0 = suppress, 1 = neutral, >1 = amplify)"
|
||||
},
|
||||
"severity_override": {
|
||||
"type": "string",
|
||||
"enum": ["critical", "high", "medium", "low", "info"]
|
||||
},
|
||||
"justification": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"policy_trace": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"rule_id": { "type": "string" },
|
||||
"result": { "type": "string" },
|
||||
"reason": { "type": "string" }
|
||||
}
|
||||
}
|
||||
},
|
||||
"evaluated_at": {
|
||||
"type": "string",
|
||||
"format": "date-time"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"properties": {
|
||||
"inputs": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/definitions/ReachabilityInput"
|
||||
}
|
||||
}
|
||||
},
|
||||
"examples": [
|
||||
{
|
||||
"inputs": [
|
||||
{
|
||||
"subject": {
|
||||
"purl": "pkg:npm/lodash@4.17.20",
|
||||
"cve_id": "CVE-2021-23337",
|
||||
"affected_symbols": ["lodash.template"]
|
||||
},
|
||||
"reachability_facts": [
|
||||
{
|
||||
"state": "reachable",
|
||||
"confidence": 0.95,
|
||||
"source": "static_analysis",
|
||||
"analyzer": "stellaops-scanner",
|
||||
"analyzer_version": "2025.10.0",
|
||||
"call_path": {
|
||||
"depth": 3,
|
||||
"nodes": [
|
||||
{ "id": "n1", "symbol": "app.renderTemplate", "is_entry_point": true },
|
||||
{ "id": "n2", "symbol": "templateEngine.compile" },
|
||||
{ "id": "n3", "symbol": "lodash.template", "is_vulnerable": true }
|
||||
],
|
||||
"edges": [
|
||||
{ "source": "n1", "target": "n2", "call_type": "direct" },
|
||||
{ "source": "n2", "target": "n3", "call_type": "direct" }
|
||||
]
|
||||
},
|
||||
"entry_points": [
|
||||
{
|
||||
"type": "http_endpoint",
|
||||
"identifier": "POST /api/render",
|
||||
"exposed": true,
|
||||
"authentication_required": true
|
||||
}
|
||||
],
|
||||
"evaluated_at": "2025-12-06T10:00:00Z"
|
||||
}
|
||||
],
|
||||
"exploitability_facts": [
|
||||
{
|
||||
"state": "exploitable",
|
||||
"confidence": 0.8,
|
||||
"source": "epss",
|
||||
"epss_score": 0.42,
|
||||
"epss_percentile": 87,
|
||||
"kev_listed": false,
|
||||
"exploit_maturity": "functional",
|
||||
"evaluated_at": "2025-12-06T10:00:00Z"
|
||||
}
|
||||
],
|
||||
"entropy_score": {
|
||||
"overall": 0.85,
|
||||
"sbom_completeness": 0.95,
|
||||
"callgraph_coverage": 0.78,
|
||||
"analyzer_confidence": 0.9
|
||||
},
|
||||
"timestamp": "2025-12-06T10:00:00Z"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user