{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://bowtiekreative.example/schemas/laka-security/finding.schema.json","title":"LAKA Security Finding","type":"object","additionalProperties":true,"required":["finding_id","client_id","asset_id","title","weakness","impact","reachable","internet_exposed","asset_criticality","confidence","control_state","evidence"],"properties":{"finding_id":{"type":"string","minLength":3},"client_id":{"type":"string","minLength":1},"asset_id":{"type":"string","minLength":1},"title":{"type":"string","minLength":1},"weakness":{"type":"string","minLength":1},"impact":{"enum":["unknown","information-disclosure","data-exposure","data-loss","integrity-loss","availability-loss","account-takeover","auth-bypass","rce","privilege-escalation","tenant-escape"]},"active_compromise":{"type":"boolean"},"known_exploited":{"type":"boolean"},"reachable":{"type":"boolean"},"internet_exposed":{"type":"boolean"},"asset_criticality":{"type":"integer","minimum":1,"maximum":5},"confidence":{"type":"integer","minimum":1,"maximum":5},"cvss":{"type":"number","minimum":0,"maximum":10},"cvss_vector":{"type":"string"},"epss":{"type":"number","minimum":0,"maximum":1},"cve":{"type":"string","pattern":"^CVE-[0-9]{4}-[0-9]{4,}$"},"control_state":{"enum":["unknown","absent","partial","verified","failed","bypassed","compensated"]},"compensating_controls":{"type":"array","items":{"type":"string"}},"attack_path":{"type":"array","items":{"type":"string"}},"evidence":{"type":"array","minItems":1,"items":{"type":"object","required":["kind","reference","collected_at"],"properties":{"kind":{"type":"string"},"reference":{"type":"string"},"collected_at":{"type":"string","format":"date-time"},"sha256":{"type":"string","pattern":"^[a-fA-F0-9]{64}$"},"redacted":{"type":"boolean"}}}},"owner":{"type":"string"},"status":{"enum":["observed","validated","prioritized","assigned","planned","mitigating","retest-pending","closed","accepted","false-positive"]}}}