finding example

finding finding-example.yaml

This material is a defensive specification and reference set. It is not an attack tool, a scanner, a certification, or evidence of a completed assessment. It does not automate exploitation; active or state-changing operations require a valid authorization manifest, an in-scope target, an allowed mode, verified preconditions and verified rollback.

Validates against the finding schema — try it: POST /v1/validate with {"schema": "finding", "document": …}.

The document (YAML original)

examples/finding-example.yaml — all identifiers and targets are demonstration placeholders

finding_id: FIND-DEMO-001
client_id: client-demo
asset_id: demo-vps-01
title: Public service is affected by a known-exploited vulnerability
weakness: Remote code execution in an internet-facing service
impact: rce
active_compromise: false
known_exploited: true
reachable: true
internet_exposed: true
asset_criticality: 5
confidence: 5
cvss: 9.8
cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
epss: 0.72
cve: CVE-2025-12345
control_state: absent
compensating_controls: []
attack_path:
  - internet
  - public-service
  - vulnerable-component
evidence:
  - kind: scanner-report
    reference: evidence://client-demo/findings/FIND-DEMO-001.json
    collected_at: "2026-09-03T10:00:00-06:00"
    sha256: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
    redacted: true
owner: platform-team
status: validated

As JSON

Converted at build time; served at /v1/examples/finding-example

{
  "finding_id": "FIND-DEMO-001",
  "client_id": "client-demo",
  "asset_id": "demo-vps-01",
  "title": "Public service is affected by a known-exploited vulnerability",
  "weakness": "Remote code execution in an internet-facing service",
  "impact": "rce",
  "active_compromise": false,
  "known_exploited": true,
  "reachable": true,
  "internet_exposed": true,
  "asset_criticality": 5,
  "confidence": 5,
  "cvss": 9.8,
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.72,
  "cve": "CVE-2025-12345",
  "control_state": "absent",
  "compensating_controls": [],
  "attack_path": [
    "internet",
    "public-service",
    "vulnerable-component"
  ],
  "evidence": [
    {
      "kind": "scanner-report",
      "reference": "evidence://client-demo/findings/FIND-DEMO-001.json",
      "collected_at": "2026-09-03T10:00:00-06:00",
      "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
      "redacted": true
    }
  ],
  "owner": "platform-team",
  "status": "validated"
}

This example as JSON →