LAKA Security Finding

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://bowtiekreative.example/schemas/laka-security/finding.schema.json",
  "title": "LAKA Security Finding",
  "type": "object",
  "additionalProperties": true,
  "required": [
    "finding_id",
    "client_id",
    "asset_id",
    "title",
    "weakness",
    "impact",
    "reachable",
    "internet_exposed",
    "asset_criticality",
    "confidence",
    "control_state",
    "evidence"
  ],
  "properties": {
    "finding_id": {
      "type": "string",
      "minLength": 3
    },
    "client_id": {
      "type": "string",
      "minLength": 1
    },
    "asset_id": {
      "type": "string",
      "minLength": 1
    },
    "title": {
      "type": "string",
      "minLength": 1
    },
    "weakness": {
      "type": "string",
      "minLength": 1
    },
    "impact": {
      "enum": [
        "unknown",
        "information-disclosure",
        "data-exposure",
        "data-loss",
        "integrity-loss",
        "availability-loss",
        "account-takeover",
        "auth-bypass",
        "rce",
        "privilege-escalation",
        "tenant-escape"
      ]
    },
    "active_compromise": {
      "type": "boolean"
    },
    "known_exploited": {
      "type": "boolean"
    },
    "reachable": {
      "type": "boolean"
    },
    "internet_exposed": {
      "type": "boolean"
    },
    "asset_criticality": {
      "type": "integer",
      "minimum": 1,
      "maximum": 5
    },
    "confidence": {
      "type": "integer",
      "minimum": 1,
      "maximum": 5
    },
    "cvss": {
      "type": "number",
      "minimum": 0,
      "maximum": 10
    },
    "cvss_vector": {
      "type": "string"
    },
    "epss": {
      "type": "number",
      "minimum": 0,
      "maximum": 1
    },
    "cve": {
      "type": "string",
      "pattern": "^CVE-[0-9]{4}-[0-9]{4,}$"
    },
    "control_state": {
      "enum": [
        "unknown",
        "absent",
        "partial",
        "verified",
        "failed",
        "bypassed",
        "compensated"
      ]
    },
    "compensating_controls": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "attack_path": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "evidence": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "required": [
          "kind",
          "reference",
          "collected_at"
        ],
        "properties": {
          "kind": {
            "type": "string"
          },
          "reference": {
            "type": "string"
          },
          "collected_at": {
            "type": "string",
            "format": "date-time"
          },
          "sha256": {
            "type": "string",
            "pattern": "^[a-fA-F0-9]{64}$"
          },
          "redacted": {
            "type": "boolean"
          }
        }
      }
    },
    "owner": {
      "type": "string"
    },
    "status": {
      "enum": [
        "observed",
        "validated",
        "prioritized",
        "assigned",
        "planned",
        "mitigating",
        "retest-pending",
        "closed",
        "accepted",
        "false-positive"
      ]
    }
  }
}