{
"API Vulnerabilities": {
"columns": [
{
"column_name": "component_id",
"type": "LONGINTEGER",
"label": "Dependency ID",
"description": "The id of the component/dependency that the vulnerability affects"
},
{
"column_name": "vulnerability_id",
"type": "STRING",
"label": "ID",
"description": "the id of the vulnerability"
},
{
"column_name": "vector",
"type": "STRING",
"label": "Vector",
"description": "The cvss vector of the vulnerability"
},
{
"column_name": "severity_string",
"type": "STRING",
"label": "Severity String",
"description": "severity string of the vulnerability (e.g Medium)"
},
{
"column_name": "base_severity_string",
"type": "STRING",
"label": "Base Severity String",
"description": "Text representation of the base severity level of the vulnerability"
},
{
"column_name": "advisory_status",
"type": "STRING",
"label": "Advisory Status",
"description": "current status of the advisory related to the vulnerability (e.g. draft, published, approved, rejected)"
},
{
"column_name": "final_severity",
"type": "INTEGER",
"label": "Final Severity",
"description": "0 if a user/3rd part advisory that lowers the severity, if not lowered then its the severity of the vulnerability"
},
{
"column_name": "tool",
"type": "STRING",
"label": "Tool",
"description": "The tool that found the vulnerability"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "pipeline_run_id",
"type": "LONGINTEGER",
"label": "Pipeline Run Id",
"description": "Version(pipeline run) id that contains the vulnerability"
},
{
"column_name": "pkg",
"type": "STRING",
"label": "Pkg",
"description": "The package manager of the dependency that contains the vulnerability"
},
{
"column_name": "latest_package_version",
"type": "STRING",
"label": "Dependency Latest Version",
"description": "The latest known versison of the dependency"
},
{
"column_name": "attestation_ids",
"type": "LONGINTEGERARRAY",
"label": "Attestation IDs",
"description": "The ids of the attestations in which the vulnerability was found"
},
{
"column_name": "cvss_score",
"type": "FLOAT",
"label": "CVSS",
"description": "The cvss score of the vulnerability"
},
{
"column_name": "logical_app",
"type": "STRING",
"label": "Product",
"description": "Product name"
},
{
"column_name": "vul_component_fixed_in_versions",
"type": "STRINGARRAY",
"label": "Vulnerability Fix Version",
"description": "The versions of the component in which the vulnerability as fixed"
},
{
"column_name": "will_not_fix",
"type": "BOOLEAN",
"label": "Will Not Fix",
"description": "Reported by the source as the vulnerability on this component will not be fixed"
},
{
"column_name": "attestation_name",
"type": "STRING",
"label": "Attestation Name",
"description": "The name of the attestation where the vulnerability was found [CHECK]"
},
{
"column_name": "tag",
"type": "STRING",
"label": "Component Version",
"description": "The version of the component to which the vulnerability effects"
},
{
"column_name": "targetName",
"type": "STRING",
"label": "Component",
"description": "The name of the attestation where the vulnerability was found"
},
{
"column_name": "base_score",
"type": "FLOAT",
"label": "Base Score",
"description": "The severity score of the vulnerability (e.g 4)"
},
{
"column_name": "source_layer",
"type": "STRING",
"label": "Layer",
"description": "container/image layer where vulnerability was introduced"
},
{
"column_name": "text",
"type": "STRING",
"label": "Text",
"description": "Details about the vulnerability as provided by the advisory"
},
{
"column_name": "is_latest_logical_version",
"type": "BOOLEAN",
"label": "Latest product version",
"description": "True if this version is the latest"
},
{
"column_name": "update",
"type": "BOOLEAN",
"label": "Update",
"description": "[CHECK]"
},
{
"column_name": "cwe_array",
"type": "",
"label": "CWEs",
"description": "array of CWE ID's"
},
{
"column_name": "has_fix",
"type": "BOOLEAN",
"label": "Has Fix",
"description": "Resolves to TRUE if vulnerability has a fixed version"
},
{
"column_name": "component_purl",
"type": "STRING",
"label": "Dependency PURL",
"description": "The package url of the effected dependency"
},
{
"column_name": "component_version",
"type": "STRING",
"label": "Dependency Version",
"description": "the version of the dependency/component that is vulnerable"
},
{
"column_name": "component_locations",
"type": "STRING",
"label": "Dependency Locations",
"description": "The path to where the dependency was imported from into the project"
},
{
"column_name": "vul_date_changed",
"type": "DATETIMETZ",
"label": "Vulnerability Last Change",
"description": "Timestamp of most recent vulnerability change"
},
{
"column_name": "vul_component_created",
"type": "DATETIMETZ",
"label": "Dependency Date",
"description": "Time when the vulnerability component was inserted into the table"
},
{
"column_name": "epssProbability",
"type": "FLOAT",
"label": "EPSS",
"description": "The epss percentage for the vulnerability"
},
{
"column_name": "vendor",
"type": "JSONB",
"label": "Vendor",
"description": "The vendor of the application who provided the advisory"
},
{
"column_name": "direct_cwes",
"type": "STRING",
"label": "Direct Cwes",
"description": ""
},
{
"column_name": "advisory_modified",
"type": "DATETIMETZ",
"label": "Advisory Modified",
"description": "The timestamp refelecting the time in which the advisory was updated"
},
{
"column_name": "hyper_links",
"type": "STRINGARRAY",
"label": "Hyper Links",
"description": "Hyper links provided by the advisory"
},
{
"column_name": "advisory_text",
"type": "STRING",
"label": "Advisory Text",
"description": "The description given about the vulnerability from this advisory"
},
{
"column_name": "cwes",
"type": "JSONB",
"label": "CWE_Object",
"description": "The CWEs associated with the vulnerability"
},
{
"column_name": "advisory_justification",
"type": "STRING",
"label": "Advisory Justification",
"description": "Justification when marking a product version as not affected by a specific vulnerability"
},
{
"column_name": "component_dependency_type",
"type": "STRINGARRAY",
"label": "Component Dependency Type",
"description": "The relationship of the component to the overall system"
},
{
"column_name": "cpes",
"type": "STRINGARRAY",
"label": "Dependency CPEs",
"description": "cpes of the depencies that are affected by the vulnerability"
},
{
"column_name": "has_kev",
"type": "BOOLEAN",
"label": "Has KEV",
"description": "The vulnerability is a Known Exploitable Vulnerability"
},
{
"column_name": "version_timestamp",
"type": "DATETIMETZ",
"label": "Version Timestamp",
"description": "The timestamp of the version to which the vulnerability belongs"
},
{
"column_name": "severity",
"type": "INTEGER",
"label": "Original Severity",
"description": "The severity score of the vulnerability (e,g 8)"
},
{
"column_name": "epssPercentile",
"type": "FLOAT",
"label": "Epsspercentile",
"description": "The percentile rank of the EPSS score, indicating how likely the vulnerability is to be exploited compared to others"
},
{
"column_name": "epssScoreDate",
"type": "DATETIMETZ",
"label": "Epssscoredate",
"description": "The date when the EPSS (Exploit Prediction Scoring System) score was last updated for the vulnerability"
},
{
"column_name": "vul_adv_id",
"type": "LONGINTEGER",
"label": "Vul Adv Id",
"description": "Unique identifier for the vulnerability advisory record"
},
{
"column_name": "dependency_analysis",
"type": "JSONB",
"label": "Dependency Analysis",
"description": "Details on how the dependency was introduced: direct or transitive (dependent library of a library), through source (e.g. package.json) or image (e.g. Dockerfile)"
},
{
"column_name": "main_tool",
"type": "STRING",
"label": "Main Tool",
"description": "Tool that found the vulnerability"
},
{
"column_name": "vul_published_on",
"type": "DATETIMETZ",
"label": "Published",
"description": "When the vulnerability was published"
},
{
"column_name": "vul_hyperlinks",
"type": "JSONB",
"label": "References",
"description": "Hyperlinks provided by the vul advisory to sources of the vulnerability"
},
{
"column_name": "component_name",
"type": "STRING",
"label": "Dependency",
"description": "The name of the dependency/component that is vulnerable"
},
{
"column_name": "product_id",
"type": "LONGINTEGER",
"label": "Product Id",
"description": "table id of the product"
},
{
"column_name": "labels",
"type": "STRING",
"label": "Labels",
"description": "Labels set by valint or user whe uploading the attestation"
},
{
"column_name": "vul_source",
"type": "STRING",
"label": "Source",
"description": "The advisory who reported the vulnerability"
},
{
"column_name": "targets",
"type": "STRING",
"label": "Targets",
"description": "List of components affected by the vulnerability"
},
{
"column_name": "logical_app_version",
"type": "STRING",
"label": "Version",
"description": "Version of the product"
},
{
"column_name": "id",
"type": "LONGINTEGER",
"label": "Id",
"description": "Identfier of the row"
}
],
"md": "## `API Vulnerabilities` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `component_id` | Dependency ID | LONGINTEGER | The id of the component/dependency that the vulnerability affects | True |\n| `vulnerability_id` | ID | STRING | the id of the vulnerability | True |\n| `vector` | Vector | STRING | The cvss vector of the vulnerability | True |\n| `severity_string` | Severity String | STRING | severity string of the vulnerability (e.g Medium) | True |\n| `base_severity_string` | Base Severity String | STRING | Text representation of the base severity level of the vulnerability | True |\n| `advisory_status` | Advisory Status | STRING | current status of the advisory related to the vulnerability (e.g. draft, published, approved, rejected) | True |\n| `final_severity` | Final Severity | INTEGER | 0 if a user/3rd part advisory that lowers the severity, if not lowered then its the severity of the vulnerability | True |\n| `tool` | Tool | STRING | The tool that found the vulnerability | True |\n| `teamId` | Teamid | LONGINTEGER | Scribe teamID (required for RLS) | True |\n| `pipeline_run_id` | Pipeline Run Id | LONGINTEGER | Version(pipeline run) id that contains the vulnerability | True |\n| `pkg` | Pkg | STRING | The package manager of the dependency that contains the vulnerability | True |\n| `latest_package_version` | Dependency Latest Version | STRING | The latest known versison of the dependency | True |\n| `attestation_ids` | Attestation IDs | LONGINTEGERARRAY | The ids of the attestations in which the vulnerability was found | True |\n| `cvss_score` | CVSS | FLOAT | The cvss score of the vulnerability | True |\n| `logical_app` | Product | STRING | Product name | True |\n| `vul_component_fixed_in_versions` | Vulnerability Fix Version | STRINGARRAY | The versions of the component in which the vulnerability as fixed | True |\n| `will_not_fix` | Will Not Fix | BOOLEAN | Reported by the source as the vulnerability on this component will not be fixed | True |\n| `attestation_name` | Attestation Name | STRING | The name of the attestation where the vulnerability was found [CHECK] | True |\n| `tag` | Component Version | STRING | The version of the component to which the vulnerability effects | True |\n| `targetName` | Component | STRING | The name of the attestation where the vulnerability was found | True |\n| `base_score` | Base Score | FLOAT | The severity score of the vulnerability (e.g 4) | True |\n| `source_layer` | Layer | STRING | container/image layer where vulnerability was introduced | True |\n| `text` | Text | STRING | Details about the vulnerability as provided by the advisory | True |\n| `is_latest_logical_version` | Latest product version | BOOLEAN | True if this version is the latest | True |\n| `update` | Update | BOOLEAN | [CHECK] | True |\n| `cwe_array` | CWEs | | array of CWE ID's | True |\n| `has_fix` | Has Fix | BOOLEAN | Resolves to TRUE if vulnerability has a fixed version | True |\n| `component_purl` | Dependency PURL | STRING | The package url of the effected dependency | True |\n| `component_version` | Dependency Version | STRING | the version of the dependency/component that is vulnerable | True |\n| `component_locations` | Dependency Locations | STRING | The path to where the dependency was imported from into the project | True |\n| `vul_date_changed` | Vulnerability Last Change | DATETIMETZ | Timestamp of most recent vulnerability change | True |\n| `vul_component_created` | Dependency Date | DATETIMETZ | Time when the vulnerability component was inserted into the table | True |\n| `epssProbability` | EPSS | FLOAT | The epss percentage for the vulnerability | True |\n| `vendor` | Vendor | JSONB | The vendor of the application who provided the advisory | True |\n| `direct_cwes` | Direct Cwes | STRING | | True |\n| `advisory_modified` | Advisory Modified | DATETIMETZ | The timestamp refelecting the time in which the advisory was updated | True |\n| `hyper_links` | Hyper Links | STRINGARRAY | Hyper links provided by the advisory | True |\n| `advisory_text` | Advisory Text | STRING | The description given about the vulnerability from this advisory | True |\n| `cwes` | CWE_Object | JSONB | The CWEs associated with the vulnerability | True |\n| `advisory_justification` | Advisory Justification | STRING | Justification when marking a product version as not affected by a specific vulnerability | True |\n| `component_dependency_type` | Component Dependency Type | STRINGARRAY | The relationship of the component to the overall system | True |\n| `cpes` | Dependency CPEs | STRINGARRAY | cpes of the depencies that are affected by the vulnerability | True |\n| `has_kev` | Has KEV | BOOLEAN | The vulnerability is a Known Exploitable Vulnerability | True |\n| `version_timestamp` | Version Timestamp | DATETIMETZ | The timestamp of the version to which the vulnerability belongs | True |\n| `severity` | Original Severity | INTEGER | The severity score of the vulnerability (e,g 8) | True |\n| `epssPercentile` | Epsspercentile | FLOAT | The percentile rank of the EPSS score, indicating how likely the vulnerability is to be exploited compared to others | True |\n| `epssScoreDate` | Epssscoredate | DATETIMETZ | The date when the EPSS (Exploit Prediction Scoring System) score was last updated for the vulnerability | True |\n| `vul_adv_id` | Vul Adv Id | LONGINTEGER | Unique identifier for the vulnerability advisory record | True |\n| `dependency_analysis` | Dependency Analysis | JSONB | Details on how the dependency was introduced: direct or transitive (dependent library of a library), through source (e.g. package.json) or image (e.g. Dockerfile) | True |\n| `main_tool` | Main Tool | STRING | Tool that found the vulnerability | True |\n| `vul_published_on` | Published | DATETIMETZ | When the vulnerability was published | True |\n| `vul_hyperlinks` | References | JSONB | Hyperlinks provided by the vul advisory to sources of the vulnerability | True |\n| `component_name` | Dependency | STRING | The name of the dependency/component that is vulnerable | True |\n| `product_id` | Product Id | LONGINTEGER | table id of the product | True |\n| `labels` | Labels | STRING | Labels set by valint or user whe uploading the attestation | True |\n| `vul_source` | Source | STRING | The advisory who reported the vulnerability | True |\n| `targets` | Targets | STRING | List of components affected by the vulnerability | True |\n| `logical_app_version` | Version | STRING | Version of the product | True |\n| `id` | Id | LONGINTEGER | Identfier of the row | True |\n\n"
},
"License per dependency": {
"columns": [
{
"column_name": "targetType",
"type": "STRING",
"label": "Comp type",
"description": "Component type (wether docker image or something else)"
},
{
"column_name": "License2",
"type": "",
"label": "License2",
"description": "Copy of License, to be used for complex queries"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "targetTypeTranslated",
"type": "",
"label": "Comp type translated",
"description": "Target type (image, source) where the dependency was found"
},
{
"column_name": "group",
"type": "STRING",
"label": "Package Mgr",
"description": "The package manager (python, pypi, npm, nuget, maven, rpm, apk, gem, binary, file, layer)"
},
{
"column_name": "latest",
"type": "BOOLEAN",
"label": "Latest",
"description": "True if the version is latest"
},
{
"column_name": "license",
"type": "STRING",
"label": "License",
"description": "License"
},
{
"column_name": "license_expression",
"type": "STRING",
"label": "License Exp.",
"description": "License experssion (when complex license combined of a few other licenses)"
},
{
"column_name": "targetName",
"type": "STRING",
"label": "Component",
"description": "The product component where the dependency was found (e.g. image nginx:1.23 that is part of a multi image product)"
},
{
"column_name": "license_is_permissive",
"type": "BOOLEAN",
"label": "Is Permissive",
"description": "True if the license is permissive"
},
{
"column_name": "rstatus",
"type": "STRING",
"label": "Version Status",
"description": "The status of the version of the product (draft, latest or published)"
},
{
"column_name": "logical_app",
"type": "STRING",
"label": "Product",
"description": "Product name"
},
{
"column_name": "logical_app_version",
"type": "STRING",
"label": "Version",
"description": "Version of the product"
},
{
"column_name": "component_version",
"type": "STRING",
"label": "Dependency Version",
"description": "The dependency version"
},
{
"column_name": "component_name",
"type": "STRING",
"label": "Dependency",
"description": "The dependency which the license applies to"
}
],
"md": "## `License per dependency` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `targetType` | Comp type | STRING | Component type (wether docker image or something else) | True |\n| `License2` | License2 | | Copy of License, to be used for complex queries | True |\n| `teamId` | Teamid | LONGINTEGER | Scribe teamID (required for RLS) | True |\n| `targetTypeTranslated` | Comp type translated | | Target type (image, source) where the dependency was found | True |\n| `group` | Package Mgr | STRING | The package manager (python, pypi, npm, nuget, maven, rpm, apk, gem, binary, file, layer) | True |\n| `latest` | Latest | BOOLEAN | True if the version is latest | True |\n| `license` | License | STRING | License | True |\n| `license_expression` | License Exp. | STRING | License experssion (when complex license combined of a few other licenses) | True |\n| `targetName` | Component | STRING | The product component where the dependency was found (e.g. image nginx:1.23 that is part of a multi image product) | True |\n| `license_is_permissive` | Is Permissive | BOOLEAN | True if the license is permissive | True |\n| `rstatus` | Version Status | STRING | The status of the version of the product (draft, latest or published) | True |\n| `logical_app` | Product | STRING | Product name | True |\n| `logical_app_version` | Version | STRING | Version of the product | True |\n| `component_version` | Dependency Version | STRING | The dependency version | True |\n| `component_name` | Dependency | STRING | The dependency which the license applies to | True |\n\n"
},
"asbom_filtered": {
"columns": [
{
"column_name": "more",
"type": "",
"label": " ",
"description": "UI expandable element containing detailed component information"
},
{
"column_name": "license_is_permissive_na",
"type": "BOOLEAN",
"label": "License Is Permissive Na",
"description": "Permissive license flag with false default for unknown licenses"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "component_version",
"type": "STRING",
"label": "Dep version",
"description": "Exact version of the component currently in use"
},
{
"column_name": "license_expression",
"type": "STRING",
"label": "Licesne expression",
"description": "Complex license expression for dual or conditional licensing"
},
{
"column_name": "pkg",
"type": "STRING",
"label": "Package Manager",
"description": "Package manager (duplicate of component_group for compatibility)"
},
{
"column_name": "rstatus",
"type": "STRING",
"label": "Version Status",
"description": "Version publication status (Latest, Published, or Draft)"
},
{
"column_name": "component_purl",
"type": "STRING",
"label": "PURL",
"description": "Package URL - universal component identifier across ecosystems"
},
{
"column_name": "dependency_parents",
"type": "STRINGARRAY",
"label": "Dependency Parents",
"description": "Array of components that depend on this component"
},
{
"column_name": "dependency_children",
"type": "STRINGARRAY",
"label": "Dependency Children",
"description": "Array of components that this component depends on"
},
{
"column_name": "component_dependency_type",
"type": "STRINGARRAY",
"label": "Component Dependency Type",
"description": "Array of dependency types (runtime, compile, test, optional, development)"
},
{
"column_name": "logical_app",
"type": "STRING",
"label": "Product",
"description": "Product name"
},
{
"column_name": "logical_app_version",
"type": "STRING",
"label": "Version",
"description": "Version of the product"
},
{
"column_name": "scorecard_id",
"type": "LONGINTEGER",
"label": "Scorecard Id",
"description": "Reference to detailed OpenSSF Scorecard analysis record"
},
{
"column_name": "version_is_up_to_date",
"type": "BOOLEAN",
"label": "Up-to-date",
"description": "Boolean indicating if the component is using the latest available version"
},
{
"column_name": "product_id",
"type": "LONGINTEGER",
"label": "Product Id",
"description": "Unique identifier of the product/application containing this component"
},
{
"column_name": "attestation_name",
"type": "STRING",
"label": "Attestation Name",
"description": "Name of the attestation that discovered this component"
},
{
"column_name": "high_severity_cves",
"type": "INTEGER",
"label": "C+H Vulns",
"description": "Count of critical and high severity vulnerabilities"
},
{
"column_name": "maintenance_score",
"type": "STRING",
"label": "Maintenance Score",
"description": "Text representation of component maintenance health assessment"
},
{
"column_name": "component_name",
"type": "STRING",
"label": "Dependency",
"description": "Full name of the component including namespace if applicable"
},
{
"column_name": "labels",
"type": "STRING",
"label": "Labels",
"description": "Custom tags for categorization and filtering (tier, environment, etc.)"
},
{
"column_name": "licenses",
"type": "STRING",
"label": "Licenses",
"description": "SPDX license identifiers for the component"
},
{
"column_name": "attestation_ids",
"type": "LONGINTEGERARRAY",
"label": "Attestation Ids",
"description": "Array of attestation record IDs linked to this component"
},
{
"column_name": "component_external_ref",
"type": "STRING",
"label": "Component External Ref",
"description": "URL to component repository, documentation, or homepage"
},
{
"column_name": "license_expression_na",
"type": "STRING",
"label": "License Expression Na",
"description": "License expression with N/A displayed for missing license data"
},
{
"column_name": "component_publisher",
"type": "STRING",
"label": "Component Publisher",
"description": "Organization or individual who published the component to the package registry"
},
{
"column_name": "component_description",
"type": "STRING",
"label": "Component Description",
"description": "Brief description of the component's functionality and purpose"
},
{
"column_name": "targets_translated",
"type": "",
"label": "SBOM Type Translated",
"description": "User-friendly SBOM type (container\u2192image, git\u2192source)"
},
{
"column_name": "component_author",
"type": "STRING",
"label": "Component Author",
"description": "Original creator or maintainer of the component"
},
{
"column_name": "relation",
"type": "",
"label": "Relation",
"description": "Human-readable summary of dependency relationships"
},
{
"column_name": "main_tool",
"type": "",
"label": "Main Tool",
"description": "Primary scanner tool that generated this SBOM entry"
},
{
"column_name": "maintenance_score_int",
"type": "INTEGER",
"label": "Maintenance Score",
"description": "The dependency's OpenSSF maintenance score (as an integer) [Check]"
},
{
"column_name": "block",
"type": "",
"label": "Dependency",
"description": ""
},
{
"column_name": "tools",
"type": "STRING",
"label": "Tools",
"description": "Comma-separated list of scanners that detected this component"
},
{
"column_name": "license_is_permissive",
"type": "BOOLEAN",
"label": "Is permissive",
"description": "Boolean indicating if the license allows free use (true for MIT/Apache, false for GPL)"
},
{
"column_name": "scorecard_score",
"type": "FLOAT",
"label": "OpenSSF score",
"description": "OpenSSF security score (0.0-10.0) measuring security practices"
},
{
"column_name": "targets",
"type": "STRING",
"label": "SBOM Type",
"description": "SBOM type indicating source (container, git, package, file, etc.)"
},
{
"column_name": "component_type",
"type": "STRING",
"label": "Component type",
"description": "Component classification (library, framework, application, etc.)"
},
{
"column_name": "source_layer",
"type": "STRING",
"label": "Layer",
"description": "Container layer or source location where component was introduced"
},
{
"column_name": "component_locations",
"type": "JSONB",
"label": "Component Locations",
"description": "JSON array of file paths and locations where component is used"
},
{
"column_name": "component_id",
"type": "LONGINTEGER",
"label": "Component Id",
"description": "Id of the component foud in the attestation"
},
{
"column_name": "id",
"type": "LONGINTEGER",
"label": "Id",
"description": "Unique record identifier for this SBOM entry"
},
{
"column_name": "base_layer",
"type": "BOOLEAN",
"label": "Base Image",
"description": "is dependency coming from a an image layer that is a known base layer"
},
{
"column_name": "latest_version",
"type": "STRING",
"label": "Dep latest ver",
"description": "Most recent version available in the package registry"
},
{
"column_name": "tag",
"type": "STRING",
"label": "Component version",
"description": "Version tag or release identifier for the component"
},
{
"column_name": "targetName",
"type": "STRING",
"label": "Component",
"description": "Primary name of the component as it appears in the package manager"
},
{
"column_name": "component_group",
"type": "STRING",
"label": "Component Group",
"description": "Package manager or ecosystem (npm, maven, pypi, docker, gem, go, etc.)"
},
{
"column_name": "version_timestamp",
"type": "DATETIMETZ",
"label": "Version Timestamp",
"description": "Earliest upload timestamp of an attestation in the currently in the product version"
},
{
"column_name": "attestation_ids_cnt",
"type": "INTEGER",
"label": "Attestation Ids Cnt",
"description": "Count of security attestations that have verified this component"
},
{
"column_name": "pipeline_run_id",
"type": "LONGINTEGER",
"label": "Pipeline Run Id",
"description": "Identifier of the ETL pipeline execution that created/updated this record"
}
],
"md": "## `asbom_filtered` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `more` | | | UI expandable element containing detailed component information | True |\n| `license_is_permissive_na` | License Is Permissive Na | BOOLEAN | Permissive license flag with false default for unknown licenses | True |\n| `teamId` | Teamid | LONGINTEGER | Scribe teamID (required for RLS) | True |\n| `component_version` | Dep version | STRING | Exact version of the component currently in use | True |\n| `license_expression` | Licesne expression | STRING | Complex license expression for dual or conditional licensing | True |\n| `pkg` | Package Manager | STRING | Package manager (duplicate of component_group for compatibility) | True |\n| `rstatus` | Version Status | STRING | Version publication status (Latest, Published, or Draft) | True |\n| `component_purl` | PURL | STRING | Package URL - universal component identifier across ecosystems | True |\n| `dependency_parents` | Dependency Parents | STRINGARRAY | Array of components that depend on this component | True |\n| `dependency_children` | Dependency Children | STRINGARRAY | Array of components that this component depends on | True |\n| `component_dependency_type` | Component Dependency Type | STRINGARRAY | Array of dependency types (runtime, compile, test, optional, development) | True |\n| `logical_app` | Product | STRING | Product name | True |\n| `logical_app_version` | Version | STRING | Version of the product | True |\n| `scorecard_id` | Scorecard Id | LONGINTEGER | Reference to detailed OpenSSF Scorecard analysis record | True |\n| `version_is_up_to_date` | Up-to-date | BOOLEAN | Boolean indicating if the component is using the latest available version | True |\n| `product_id` | Product Id | LONGINTEGER | Unique identifier of the product/application containing this component | True |\n| `attestation_name` | Attestation Name | STRING | Name of the attestation that discovered this component | True |\n| `high_severity_cves` | C+H Vulns | INTEGER | Count of critical and high severity vulnerabilities | True |\n| `maintenance_score` | Maintenance Score | STRING | Text representation of component maintenance health assessment | True |\n| `component_name` | Dependency | STRING | Full name of the component including namespace if applicable | True |\n| `labels` | Labels | STRING | Custom tags for categorization and filtering (tier, environment, etc.) | True |\n| `licenses` | Licenses | STRING | SPDX license identifiers for the component | True |\n| `attestation_ids` | Attestation Ids | LONGINTEGERARRAY | Array of attestation record IDs linked to this component | True |\n| `component_external_ref` | Component External Ref | STRING | URL to component repository, documentation, or homepage | True |\n| `license_expression_na` | License Expression Na | STRING | License expression with N/A displayed for missing license data | True |\n| `component_publisher` | Component Publisher | STRING | Organization or individual who published the component to the package registry | True |\n| `component_description` | Component Description | STRING | Brief description of the component's functionality and purpose | True |\n| `targets_translated` | SBOM Type Translated | | User-friendly SBOM type (container\u2192image, git\u2192source) | True |\n| `component_author` | Component Author | STRING | Original creator or maintainer of the component | True |\n| `relation` | Relation | | Human-readable summary of dependency relationships | True |\n| `main_tool` | Main Tool | | Primary scanner tool that generated this SBOM entry | True |\n| `maintenance_score_int` | Maintenance Score | INTEGER | The dependency's OpenSSF maintenance score (as an integer) [Check] | True |\n| `block` | Dependency | | | True |\n| `tools` | Tools | STRING | Comma-separated list of scanners that detected this component | True |\n| `license_is_permissive` | Is permissive | BOOLEAN | Boolean indicating if the license allows free use (true for MIT/Apache, false for GPL) | True |\n| `scorecard_score` | OpenSSF score | FLOAT | OpenSSF security score (0.0-10.0) measuring security practices | True |\n| `targets` | SBOM Type | STRING | SBOM type indicating source (container, git, package, file, etc.) | True |\n| `component_type` | Component type | STRING | Component classification (library, framework, application, etc.) | True |\n| `source_layer` | Layer | STRING | Container layer or source location where component was introduced | True |\n| `component_locations` | Component Locations | JSONB | JSON array of file paths and locations where component is used | True |\n| `component_id` | Component Id | LONGINTEGER | Id of the component foud in the attestation | True |\n| `id` | Id | LONGINTEGER | Unique record identifier for this SBOM entry | True |\n| `base_layer` | Base Image | BOOLEAN | is dependency coming from a an image layer that is a known base layer | True |\n| `latest_version` | Dep latest ver | STRING | Most recent version available in the package registry | True |\n| `tag` | Component version | STRING | Version tag or release identifier for the component | True |\n| `targetName` | Component | STRING | Primary name of the component as it appears in the package manager | True |\n| `component_group` | Component Group | STRING | Package manager or ecosystem (npm, maven, pypi, docker, gem, go, etc.) | True |\n| `version_timestamp` | Version Timestamp | DATETIMETZ | Earliest upload timestamp of an attestation in the currently in the product version | True |\n| `attestation_ids_cnt` | Attestation Ids Cnt | INTEGER | Count of security attestations that have verified this component | True |\n| `pipeline_run_id` | Pipeline Run Id | LONGINTEGER | Identifier of the ETL pipeline execution that created/updated this record | True |\n\n"
},
"CVE Impact v2": {
"columns": [
{
"column_name": "adv_names",
"type": "STRINGARRAY",
"label": "Adv Names",
"description": "a list of aliases for this vulnerability"
},
{
"column_name": "adv_sources",
"type": "STRINGARRAY",
"label": "Adv Sources",
"description": "List of sources that published the advisories related to the CVE"
},
{
"column_name": "logical_app",
"type": "STRING",
"label": "Product",
"description": "Product name"
},
{
"column_name": "targetName",
"type": "STRING",
"label": "Component",
"description": "name of the dependency"
},
{
"column_name": "component_purl",
"type": "STRING",
"label": "PURL",
"description": "purl for the relevant component"
},
{
"column_name": "source_layer",
"type": "STRING",
"label": "Layer",
"description": "layer this dependency is part of"
},
{
"column_name": "vul_published_on",
"type": "DATETIMETZ",
"label": "Published",
"description": "Date the CVE was published on"
},
{
"column_name": "tool",
"type": "STRING",
"label": "Tool",
"description": "the tool used to report the dependency"
},
{
"column_name": "published",
"type": "BOOLEAN",
"label": "Published",
"description": "is a fix for the vulnerability published"
},
{
"column_name": "epssScoreDate",
"type": "DATETIMETZ",
"label": "Epssscoredate",
"description": "time this vulnerability got its epss score"
},
{
"column_name": "vul_adv_id",
"type": "LONGINTEGER",
"label": "Vul Adv Id",
"description": "internal unique id for the advisory reporting the vulnerability"
},
{
"column_name": "more",
"type": "",
"label": " Details",
"description": "additional information about the entities mentioned in this row"
},
{
"column_name": "base_severity_string",
"type": "STRING",
"label": "Base Severity String",
"description": "severity of the cve as a single word"
},
{
"column_name": "attestation_name",
"type": "STRING",
"label": "Attestation Name",
"description": "Name of attestation relating to this dependency"
},
{
"column_name": "funnel_step",
"type": "STRING",
"label": "Funnel Step",
"description": "the step this row is part of in the funnel view"
},
{
"column_name": "pkg",
"type": "STRING",
"label": "Package Mgr",
"description": "package manager used to manage the dependency"
},
{
"column_name": "vul_component_fixed_in_versions",
"type": "STRINGARRAY",
"label": "Vul Component Fixed In Versions",
"description": "dependency version for which the vulnerability is fixed"
},
{
"column_name": "main_tool",
"type": "STRING",
"label": "Main Tool",
"description": "the EPSS percentile (~ rank)"
},
{
"column_name": "vul_hyperlinks",
"type": "STRING",
"label": "References",
"description": "Known urls relating this vulnerability"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "vul_date_changed",
"type": "DATETIMETZ",
"label": "Vul Date Changed",
"description": "when was the report about the vulnerability last changed"
},
{
"column_name": "epssPercentile",
"type": "FLOAT",
"label": "Epsspercentile",
"description": "a measure of an EPSS probability relative to all other scores"
},
{
"column_name": "version_id",
"type": "LONGINTEGER",
"label": "Version ID",
"description": "internal unique id for the version of the dependency"
},
{
"column_name": "vulnerability_id",
"type": "STRING",
"label": "ID",
"description": "Global ID of the vulnerability (CVE) as determined by a CNA"
},
{
"column_name": "logical_app_version",
"type": "STRING",
"label": "Version",
"description": "Version of the product"
},
{
"column_name": "attestation_ids",
"type": "LONGINTEGERARRAY",
"label": "Attestation Ids",
"description": "list of internal ids for the attestation relating to this dependency"
},
{
"column_name": "component_dependency_type",
"type": "STRINGARRAY",
"label": "Component Dependency Type",
"description": "how the dependency is included in the software component. a list that may include DIRECT, TRANSITIVE. both can be included in the list"
},
{
"column_name": "pipeline_run_id",
"type": "LONGINTEGER",
"label": "Pipeline Run Id",
"description": "internal unique id of the pipeline run resulting in the discovery of this component"
},
{
"column_name": "advisory_text",
"type": "STRING",
"label": "Advisory Text",
"description": "freeform text descibing the vulnerability as set by a CNA"
},
{
"column_name": "severity",
"type": "INTEGER",
"label": "Severity",
"description": "severity of the cve as a single word"
},
{
"column_name": "vul_source",
"type": "STRING",
"label": "Source",
"description": "source from which this vulnerability was reported through. one of Aqua , Blackduck , DEBIAN , GHSA , NVD , OSV , OTHER , Trivy , UBUNTU , Unreported"
},
{
"column_name": "id",
"type": "LONGINTEGER",
"label": "Id",
"description": "auto generated unique ID"
},
{
"column_name": "targets",
"type": "STRING",
"label": "Targets",
"description": "Name of the target having this dependency"
},
{
"column_name": "id_tooltip",
"type": "",
"label": "ID",
"description": "an internal unique id for the db row"
},
{
"column_name": "is_latest_logical_version",
"type": "BOOLEAN",
"label": "Latest product version",
"description": "True if this version is the latest"
},
{
"column_name": "rstatus",
"type": "STRING",
"label": "Version Status",
"description": "for the version of the componen the first one that is correct out of: latet, published draft"
},
{
"column_name": "cvss_version",
"type": "STRING",
"label": "CVSS Version",
"description": "version of the cvss from which the cvss vector is extracted"
},
{
"column_name": "labels",
"type": "STRING",
"label": "Labels",
"description": "a list of labels for the dependency"
},
{
"column_name": "component_locations",
"type": "STRING",
"label": "Component Locations",
"description": "A list of json objects describing where the vulnerable dependency has been found (path, layer, etc.)"
},
{
"column_name": "tag",
"type": "STRING",
"label": "Component Version",
"description": "version, tag or sha of the dependency"
},
{
"column_name": "vul_component_created",
"type": "DATETIMETZ",
"label": "Discovered",
"description": "Date this vulnerability discovered by scribe systems"
},
{
"column_name": "Layer",
"type": "",
"label": "Layer",
"description": "layer this dependency is part of"
},
{
"column_name": "cwes",
"type": "JSONB",
"label": "CWEs",
"description": "a list of related cwe as a json dictionary mapping id and title to the relevant links"
},
{
"column_name": "latest_count",
"type": "LONGINTEGER",
"label": "Latest Count",
"description": "The recency ranking of the version in the product (ranking of 1 means it's the latest version)"
},
{
"column_name": "latest_package_version",
"type": "STRING",
"label": "Latest Package Version",
"description": "Latest available package version for this dependency"
},
{
"column_name": "severity_string",
"type": "STRING",
"label": "Severity String",
"description": "severity of the cve as a single word"
},
{
"column_name": "version_timestamp",
"type": "DATETIMETZ",
"label": "Version timestamp",
"description": "when was the dependency version created"
},
{
"column_name": "vector",
"type": "STRING",
"label": "CVSS Vector",
"description": "CVSS vector for the vulnerability"
},
{
"column_name": "vul_severity_string",
"type": "",
"label": "Severity",
"description": "severity of the vulnerability as a single word"
},
{
"column_name": "cvss_score",
"type": "FLOAT",
"label": "CVSS",
"description": "CVSS score for the vulnerability"
},
{
"column_name": "epssProbability",
"type": "FLOAT",
"label": "EPSS",
"description": "an epss probability score for the vulnerability"
},
{
"column_name": "direct_cwes",
"type": "STRING",
"label": "Direct Cwes",
"description": "List of Common Weakness Enumerations (CWEs) directly associated with the CVE"
},
{
"column_name": "block",
"type": "STRING",
"label": "Vulnerability",
"description": "textual description of the vulnerability"
},
{
"column_name": "has_kev",
"type": "BOOLEAN",
"label": "Has KEV",
"description": "Does this vulnerability have a KEV"
},
{
"column_name": "has_fix",
"type": "BOOLEAN",
"label": "Has Fix",
"description": "does this vulnerability have a fix"
},
{
"column_name": "component_id",
"type": "LONGINTEGER",
"label": "Component ID",
"description": "internal unique id of the dependency"
},
{
"column_name": "product_id",
"type": "LONGINTEGER",
"label": "Product ID",
"description": "internal unique id for the pipeline reporting this dependency"
},
{
"column_name": "component_version",
"type": "STRING",
"label": "Dependency Version",
"description": "the version of the dependency reported in the pipeline run"
},
{
"column_name": "component_name",
"type": "STRING",
"label": "Dependency",
"description": "The name of the dependency this line reffers to"
},
{
"column_name": "dependency_analysis",
"type": "JSONB",
"label": "Dependency Analysis",
"description": "Indicates which dependencies are involved in or affected by the vulnerability"
},
{
"column_name": "relation",
"type": "",
"label": "Relation",
"description": "how the dependency is included in the software component. DIRECT, TRANSITIVE or BOTH"
}
],
"md": "## `CVE Impact v2` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `adv_names` | Adv Names | STRINGARRAY | a list of aliases for this vulnerability | True |\n| `adv_sources` | Adv Sources | STRINGARRAY | List of sources that published the advisories related to the CVE | True |\n| `logical_app` | Product | STRING | Product name | True |\n| `targetName` | Component | STRING | name of the dependency | True |\n| `component_purl` | PURL | STRING | purl for the relevant component | True |\n| `source_layer` | Layer | STRING | layer this dependency is part of | True |\n| `vul_published_on` | Published | DATETIMETZ | Date the CVE was published on | True |\n| `tool` | Tool | STRING | the tool used to report the dependency | True |\n| `published` | Published | BOOLEAN | is a fix for the vulnerability published | True |\n| `epssScoreDate` | Epssscoredate | DATETIMETZ | time this vulnerability got its epss score | True |\n| `vul_adv_id` | Vul Adv Id | LONGINTEGER | internal unique id for the advisory reporting the vulnerability | True |\n| `more` | Details | | additional information about the entities mentioned in this row | True |\n| `base_severity_string` | Base Severity String | STRING | severity of the cve as a single word | True |\n| `attestation_name` | Attestation Name | STRING | Name of attestation relating to this dependency | True |\n| `funnel_step` | Funnel Step | STRING | the step this row is part of in the funnel view | True |\n| `pkg` | Package Mgr | STRING | package manager used to manage the dependency | True |\n| `vul_component_fixed_in_versions` | Vul Component Fixed In Versions | STRINGARRAY | dependency version for which the vulnerability is fixed | True |\n| `main_tool` | Main Tool | STRING | the EPSS percentile (~ rank) | True |\n| `vul_hyperlinks` | References | STRING | Known urls relating this vulnerability | True |\n| `teamId` | Teamid | LONGINTEGER | Scribe teamID (required for RLS) | True |\n| `vul_date_changed` | Vul Date Changed | DATETIMETZ | when was the report about the vulnerability last changed | True |\n| `epssPercentile` | Epsspercentile | FLOAT | a measure of an EPSS probability relative to all other scores | True |\n| `version_id` | Version ID | LONGINTEGER | internal unique id for the version of the dependency | True |\n| `vulnerability_id` | ID | STRING | Global ID of the vulnerability (CVE) as determined by a CNA | True |\n| `logical_app_version` | Version | STRING | Version of the product | True |\n| `attestation_ids` | Attestation Ids | LONGINTEGERARRAY | list of internal ids for the attestation relating to this dependency | True |\n| `component_dependency_type` | Component Dependency Type | STRINGARRAY | how the dependency is included in the software component. a list that may include DIRECT, TRANSITIVE. both can be included in the list | True |\n| `pipeline_run_id` | Pipeline Run Id | LONGINTEGER | internal unique id of the pipeline run resulting in the discovery of this component | True |\n| `advisory_text` | Advisory Text | STRING | freeform text descibing the vulnerability as set by a CNA | True |\n| `severity` | Severity | INTEGER | severity of the cve as a single word | True |\n| `vul_source` | Source | STRING | source from which this vulnerability was reported through. one of Aqua , Blackduck , DEBIAN , GHSA , NVD , OSV , OTHER , Trivy , UBUNTU , Unreported | True |\n| `id` | Id | LONGINTEGER | auto generated unique ID | True |\n| `targets` | Targets | STRING | Name of the target having this dependency | True |\n| `id_tooltip` | ID | | an internal unique id for the db row | True |\n| `is_latest_logical_version` | Latest product version | BOOLEAN | True if this version is the latest | True |\n| `rstatus` | Version Status | STRING | for the version of the componen the first one that is correct out of: latet, published draft | True |\n| `cvss_version` | CVSS Version | STRING | version of the cvss from which the cvss vector is extracted | True |\n| `labels` | Labels | STRING | a list of labels for the dependency | True |\n| `component_locations` | Component Locations | STRING | A list of json objects describing where the vulnerable dependency has been found (path, layer, etc.) | True |\n| `tag` | Component Version | STRING | version, tag or sha of the dependency | True |\n| `vul_component_created` | Discovered | DATETIMETZ | Date this vulnerability discovered by scribe systems | True |\n| `Layer` | Layer | | layer this dependency is part of | True |\n| `cwes` | CWEs | JSONB | a list of related cwe as a json dictionary mapping id and title to the relevant links | True |\n| `latest_count` | Latest Count | LONGINTEGER | The recency ranking of the version in the product (ranking of 1 means it's the latest version) | True |\n| `latest_package_version` | Latest Package Version | STRING | Latest available package version for this dependency | True |\n| `severity_string` | Severity String | STRING | severity of the cve as a single word | True |\n| `version_timestamp` | Version timestamp | DATETIMETZ | when was the dependency version created | True |\n| `vector` | CVSS Vector | STRING | CVSS vector for the vulnerability | True |\n| `vul_severity_string` | Severity | | severity of the vulnerability as a single word | True |\n| `cvss_score` | CVSS | FLOAT | CVSS score for the vulnerability | True |\n| `epssProbability` | EPSS | FLOAT | an epss probability score for the vulnerability | True |\n| `direct_cwes` | Direct Cwes | STRING | List of Common Weakness Enumerations (CWEs) directly associated with the CVE | True |\n| `block` | Vulnerability | STRING | textual description of the vulnerability | True |\n| `has_kev` | Has KEV | BOOLEAN | Does this vulnerability have a KEV | True |\n| `has_fix` | Has Fix | BOOLEAN | does this vulnerability have a fix | True |\n| `component_id` | Component ID | LONGINTEGER | internal unique id of the dependency | True |\n| `product_id` | Product ID | LONGINTEGER | internal unique id for the pipeline reporting this dependency | True |\n| `component_version` | Dependency Version | STRING | the version of the dependency reported in the pipeline run | True |\n| `component_name` | Dependency | STRING | The name of the dependency this line reffers to | True |\n| `dependency_analysis` | Dependency Analysis | JSONB | Indicates which dependencies are involved in or affected by the vulnerability | True |\n| `relation` | Relation | | how the dependency is included in the software component. DIRECT, TRANSITIVE or BOTH | True |\n\n"
},
"policy_initiative": {
"columns": [
{
"column_name": "control_name",
"type": "STRING",
"label": "Policy Control",
"description": "Policy control name"
},
{
"column_name": "rule_name",
"type": "STRING",
"label": "Policy Rule",
"description": "The policy rule"
},
{
"column_name": "logical_app_version",
"type": "STRING",
"label": "Version",
"description": "Version of the product"
},
{
"column_name": "formatted_msg",
"type": "STRING",
"label": "Formatted Msg",
"description": "Rule result message formatted to not break json object"
},
{
"column_name": "more_json",
"type": "JSONB",
"label": "More Json",
"description": "Rule result details as a json object"
},
{
"column_name": "details",
"type": "",
"label": "Details",
"description": "Rule results details as xmlelement for display in UI"
},
{
"column_name": "initiative_name",
"type": "STRING",
"label": "Policy Initiative",
"description": "Name of the policy initiative"
},
{
"column_name": "is_latest_logical_version",
"type": "BOOLEAN",
"label": "Latest Product Version",
"description": "True if this version is the latest"
},
{
"column_name": "asset",
"type": "STRING",
"label": "Asset (Type)",
"description": "Asset the rule run on and its type in parentheses"
},
{
"column_name": "gate",
"type": "STRING",
"label": "Gate (Type)",
"description": "Location where the policy evalution took place and its type in parentheses"
},
{
"column_name": "initiative_hash",
"type": "STRING",
"label": "Initiative Hash",
"description": "Hash of the whole initiaitive (for version differentiation)"
},
{
"column_name": "count",
"type": "LONGINTEGER",
"label": "Count",
"description": "Numer of occurences of the rule evaluation on the asset with the same rule result (for vulnerabilities each vulnerability found counts as one occurrance)"
},
{
"column_name": "message",
"type": "STRING",
"label": "Message",
"description": "Rule result message"
},
{
"column_name": "logical_app",
"type": "STRING",
"label": "Product",
"description": "Product name"
},
{
"column_name": "evaluations",
"type": "JSONB",
"label": "Evaluations",
"description": "Raw SARIF of the rule result as a json object"
},
{
"column_name": "date",
"type": "DATE",
"label": "Evaluated",
"description": "Date of last policy evaluation"
},
{
"column_name": "time_evaluated",
"type": "DATETIMETZ",
"label": "Time",
"description": "Rule evaluation timestamp"
},
{
"column_name": "asset_id",
"type": "STRING",
"label": "Asset Id",
"description": "Asset identifier as extracted from the relevant API or calculated (not necessarily unique)"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "version_id",
"type": "LONGINTEGER",
"label": "Version Id",
"description": "Product version id"
},
{
"column_name": "gate_name",
"type": "STRING",
"label": "Gate Name",
"description": "Location where the policy evalution took place"
},
{
"column_name": "asset_name",
"type": "STRING",
"label": "Asset Name",
"description": "Asset the rule run on"
},
{
"column_name": "gate_type",
"type": "STRING",
"label": "Gate Type",
"description": "Location type where the policy evalution took place"
},
{
"column_name": "status",
"type": "STRING",
"label": "Status",
"description": "Rule result status"
},
{
"column_name": "asset_type",
"type": "STRING",
"label": "Asset Type",
"description": "Type of the asset the rule run on"
},
{
"column_name": "rule_id",
"type": "STRING",
"label": "Rule Id",
"description": "Policy rule ID in the format of \"rule-id:<initiative-id>/<control-id>/<rule-id>"
},
{
"column_name": "status_icon",
"type": "",
"label": "Status",
"description": "Display icon for the rule result status"
},
{
"column_name": "product_id",
"type": "LONGINTEGER",
"label": "Product Id",
"description": "Rule ID of the product"
}
],
"md": "## `policy_initiative` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `control_name` | Policy Control | STRING | Policy control name | True |\n| `rule_name` | Policy Rule | STRING | The policy rule | True |\n| `logical_app_version` | Version | STRING | Version of the product | True |\n| `formatted_msg` | Formatted Msg | STRING | Rule result message formatted to not break json object | True |\n| `more_json` | More Json | JSONB | Rule result details as a json object | True |\n| `details` | Details | | Rule results details as xmlelement for display in UI | True |\n| `initiative_name` | Policy Initiative | STRING | Name of the policy initiative | True |\n| `is_latest_logical_version` | Latest Product Version | BOOLEAN | True if this version is the latest | True |\n| `asset` | Asset (Type) | STRING | Asset the rule run on and its type in parentheses | True |\n| `gate` | Gate (Type) | STRING | Location where the policy evalution took place and its type in parentheses | True |\n| `initiative_hash` | Initiative Hash | STRING | Hash of the whole initiaitive (for version differentiation) | True |\n| `count` | Count | LONGINTEGER | Numer of occurences of the rule evaluation on the asset with the same rule result (for vulnerabilities each vulnerability found counts as one occurrance) | True |\n| `message` | Message | STRING | Rule result message | True |\n| `logical_app` | Product | STRING | Product name | True |\n| `evaluations` | Evaluations | JSONB | Raw SARIF of the rule result as a json object | True |\n| `date` | Evaluated | DATE | Date of last policy evaluation | True |\n| `time_evaluated` | Time | DATETIMETZ | Rule evaluation timestamp | True |\n| `asset_id` | Asset Id | STRING | Asset identifier as extracted from the relevant API or calculated (not necessarily unique) | True |\n| `teamId` | Teamid | LONGINTEGER | Scribe teamID (required for RLS) | True |\n| `version_id` | Version Id | LONGINTEGER | Product version id | True |\n| `gate_name` | Gate Name | STRING | Location where the policy evalution took place | True |\n| `asset_name` | Asset Name | STRING | Asset the rule run on | True |\n| `gate_type` | Gate Type | STRING | Location type where the policy evalution took place | True |\n| `status` | Status | STRING | Rule result status | True |\n| `asset_type` | Asset Type | STRING | Type of the asset the rule run on | True |\n| `rule_id` | Rule Id | STRING | Policy rule ID in the format of \"rule-id:<initiative-id>/<control-id>/<rule-id> | True |\n| `status_icon` | Status | | Display icon for the rule result status | True |\n| `product_id` | Product Id | LONGINTEGER | Rule ID of the product | True |\n\n"
},
"ProcessesData": {
"columns": [
{
"column_name": "executable",
"type": "STRING",
"label": "Executable",
"description": "The executable file run to create the process"
},
{
"column_name": "tracing",
"type": "STRING",
"label": "Tracing",
"description": "Flag indicating if this process is being traced"
},
{
"column_name": "parent",
"type": "STRING",
"label": "Parent",
"description": "Parent process ID, for spawned and execed processes"
},
{
"column_name": "cgroup",
"type": "STRING",
"label": "Cgroup",
"description": "Linux control group"
},
{
"column_name": "created",
"type": "DATETIME",
"label": "Created",
"description": "Process creation time"
},
{
"column_name": "mainAttestation",
"type": "LONGINTEGER",
"label": "Mainattestation",
"description": "The attestation ID containing the processes data"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "id",
"type": "LONGINTEGER",
"label": "Id",
"description": "Internal row identifier"
},
{
"column_name": "cmd_line",
"type": "STRING",
"label": "Cmd Line",
"description": "The full command line"
},
{
"column_name": "process_id",
"type": "STRING",
"label": "Process Id",
"description": "Process ID (str(number))"
},
{
"column_name": "work_dir",
"type": "STRING",
"label": "Work Dir",
"description": "Working directory"
},
{
"column_name": "mnt_ns",
"type": "STRING",
"label": "Mnt Ns",
"description": "Mounted namespace"
},
{
"column_name": "pid",
"type": "STRING",
"label": "Pid",
"description": "Host process id"
},
{
"column_name": "environment",
"type": "STRING",
"label": "Environment",
"description": "String containing all ENVs - names and values, provided to the process"
},
{
"column_name": "user",
"type": "STRING",
"label": "User",
"description": "User id [CHECK]"
}
],
"md": "## `ProcessesData` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `executable` | Executable | STRING | The executable file run to create the process | True |\n| `tracing` | Tracing | STRING | Flag indicating if this process is being traced | True |\n| `parent` | Parent | STRING | Parent process ID, for spawned and execed processes | True |\n| `cgroup` | Cgroup | STRING | Linux control group | True |\n| `created` | Created | DATETIME | Process creation time | True |\n| `mainAttestation` | Mainattestation | LONGINTEGER | The attestation ID containing the processes data | True |\n| `teamId` | Teamid | LONGINTEGER | Scribe teamID (required for RLS) | True |\n| `id` | Id | LONGINTEGER | Internal row identifier | True |\n| `cmd_line` | Cmd Line | STRING | The full command line | True |\n| `process_id` | Process Id | STRING | Process ID (str(number)) | True |\n| `work_dir` | Work Dir | STRING | Working directory | True |\n| `mnt_ns` | Mnt Ns | STRING | Mounted namespace | True |\n| `pid` | Pid | STRING | Host process id | True |\n| `environment` | Environment | STRING | String containing all ENVs - names and values, provided to the process | True |\n| `user` | User | STRING | User id [CHECK] | True |\n\n"
},
"FSTracker Event Data": {
"columns": [
{
"column_name": "event_environment",
"type": "STRING",
"label": "Event Environment",
"description": "Usually empty"
},
{
"column_name": "process_environment",
"type": "STRING",
"label": "Process Environment",
"description": "The environmnt variables of the process creating the event"
},
{
"column_name": "event_type",
"type": "STRING",
"label": "Event Type",
"description": "Regular or pipe (for interacting with pipes)"
},
{
"column_name": "executable",
"type": "STRING",
"label": "Executable",
"description": "The executable run to create the process"
},
{
"column_name": "cmd_line",
"type": "STRING",
"label": "Cmd Line",
"description": "The command line that originated the event, can be used to associate events with commands"
},
{
"column_name": "action",
"type": "STRING",
"label": "Action",
"description": "The type of the event (open, create, close, read, write, rename, trunc, mmap, setns, exec, load, preload, input (first open for read), output (closed after write)"
},
{
"column_name": "path",
"type": "STRING",
"label": "Path",
"description": "In cases of file event - the path of the file (open, read, execute etc.)"
},
{
"column_name": "process",
"type": "STRING",
"label": "Process",
"description": "Stringified ID of the process, can be used to join with the processes table"
},
{
"column_name": "mainAttestation_timestamp",
"type": "DATETIMETZ",
"label": "Mainattestation Timestamp",
"description": "The timestamp of the creation of event data attestation"
},
{
"column_name": "event_time",
"type": "DATETIME",
"label": "Event Time",
"description": "Time of the event"
},
{
"column_name": "mainAttestation",
"type": "LONGINTEGER",
"label": "Mainattestation",
"description": "ID of the event data attestation, can be used to retrievals or joins"
},
{
"column_name": "context",
"type": "JSONB",
"label": "Context",
"description": "The context collected when creating the attestation (information about the build pipeline, git repo etc.)"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "pipelineRun_id",
"type": "LONGINTEGER",
"label": "Pipelinerun Id",
"description": "A unique identifier of the pipelinerun_id - equivalinent to a version in Scribe."
},
{
"column_name": "event_id",
"type": "LONGINTEGER",
"label": "Event Id",
"description": "A unique identifier of the event"
},
{
"column_name": "targetName",
"type": "STRING",
"label": "Targetname",
"description": "Name of the events data attestation file"
},
{
"column_name": "pipelineRun",
"type": "STRING",
"label": "Pipelinerun",
"description": "The CI pipeline run ID (can be used to identify different pipeline runs, and to query the build system"
},
{
"column_name": "targetType",
"type": "STRING",
"label": "Targettype",
"description": "Target type of the attestation (fixed - data)"
},
{
"column_name": "contentType",
"type": "STRING",
"label": "Contenttype",
"description": "Fixed value - for FS-Tracker attestations"
},
{
"column_name": "contextType",
"type": "STRING",
"label": "Contexttype",
"description": "Type of context - marking the information it includes by build system - github, gitlab, jenkins, local etc."
},
{
"column_name": "user",
"type": "STRING",
"label": "User",
"description": "The Linux user of the process that generated the event"
}
],
"md": "## `FSTracker Event Data` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `event_environment` | Event Environment | STRING | Usually empty | True |\n| `process_environment` | Process Environment | STRING | The environmnt variables of the process creating the event | True |\n| `event_type` | Event Type | STRING | Regular or pipe (for interacting with pipes) | True |\n| `executable` | Executable | STRING | The executable run to create the process | True |\n| `cmd_line` | Cmd Line | STRING | The command line that originated the event, can be used to associate events with commands | True |\n| `action` | Action | STRING | The type of the event (open, create, close, read, write, rename, trunc, mmap, setns, exec, load, preload, input (first open for read), output (closed after write) | True |\n| `path` | Path | STRING | In cases of file event - the path of the file (open, read, execute etc.) | True |\n| `process` | Process | STRING | Stringified ID of the process, can be used to join with the processes table | True |\n| `mainAttestation_timestamp` | Mainattestation Timestamp | DATETIMETZ | The timestamp of the creation of event data attestation | True |\n| `event_time` | Event Time | DATETIME | Time of the event | True |\n| `mainAttestation` | Mainattestation | LONGINTEGER | ID of the event data attestation, can be used to retrievals or joins | True |\n| `context` | Context | JSONB | The context collected when creating the attestation (information about the build pipeline, git repo etc.) | True |\n| `teamId` | Teamid | LONGINTEGER | Scribe teamID (required for RLS) | True |\n| `pipelineRun_id` | Pipelinerun Id | LONGINTEGER | A unique identifier of the pipelinerun_id - equivalinent to a version in Scribe. | True |\n| `event_id` | Event Id | LONGINTEGER | A unique identifier of the event | True |\n| `targetName` | Targetname | STRING | Name of the events data attestation file | True |\n| `pipelineRun` | Pipelinerun | STRING | The CI pipeline run ID (can be used to identify different pipeline runs, and to query the build system | True |\n| `targetType` | Targettype | STRING | Target type of the attestation (fixed - data) | True |\n| `contentType` | Contenttype | STRING | Fixed value - for FS-Tracker attestations | True |\n| `contextType` | Contexttype | STRING | Type of context - marking the information it includes by build system - github, gitlab, jenkins, local etc. | True |\n| `user` | User | STRING | The Linux user of the process that generated the event | True |\n\n"
},
"Findings": {
"columns": [
{
"column_name": "line",
"type": "INTEGER",
"label": "Line",
"description": "line number in the source file or codebase where the vulnerability or issue was found"
},
{
"column_name": "file_path",
"type": "STRING",
"label": "Path",
"description": "The source code file/ configuration file/ component name or artifact/ path in a container or image in which the issue exists"
},
{
"column_name": "description",
"type": "STRING",
"label": "Description",
"description": "A description of the finding"
},
{
"column_name": "title",
"type": "STRING",
"label": "Title",
"description": "The title of the finding"
},
{
"column_name": "parser",
"type": "STRING",
"label": "Parser",
"description": "The tool used to generate the attestation"
},
{
"column_name": "targetName",
"type": "STRING",
"label": "Component",
"description": "The name of the attestation uploaded"
},
{
"column_name": "logical_app_version",
"type": "STRING",
"label": "Version",
"description": "Version of the product"
},
{
"column_name": "context",
"type": "JSONB",
"label": "Context",
"description": "The context of the attestation"
},
{
"column_name": "original_attestation_id",
"type": "LONGINTEGER",
"label": "Original Attestation Id",
"description": "The id of the attestation which is uploaded to be converted"
},
{
"column_name": "severity_string",
"type": "STRING",
"label": "Severity",
"description": "severity of the cve as a single word"
},
{
"column_name": "finding",
"type": "JSONB",
"label": "Finding",
"description": "A raw json record of the finding"
},
{
"column_name": "severity",
"type": "INTEGER",
"label": "Severity",
"description": "The severity of the finding which corresponds to the severity string (e.g 4)"
},
{
"column_name": "more",
"type": "",
"label": " ",
"description": "A column showing more details about the finding"
},
{
"column_name": "cvssv3",
"type": "STRING",
"label": "CVSSv3",
"description": "The cvss vector for the finding"
},
{
"column_name": "created",
"type": "DATETIMETZ",
"label": "Created",
"description": "Timestamp of when the record was inserted into the databse"
},
{
"column_name": "cwe_id",
"type": "STRING",
"label": "CWE",
"description": "The CWE ID for associated with the finding"
},
{
"column_name": "id",
"type": "LONGINTEGER",
"label": "ID",
"description": "the table id of the finding"
},
{
"column_name": "main_tool",
"type": "STRING",
"label": "Tool",
"description": "The tool used to create the attestation"
},
{
"column_name": "severity_order",
"type": "STRING",
"label": "Severity Order",
"description": "Assigns a ranking to the severity. e,g (0-Critical, 1-High)"
},
{
"column_name": "product_id",
"type": "LONGINTEGER",
"label": "Product Id",
"description": "Unique identifier for the product associated with the finding"
},
{
"column_name": "pipeline_id",
"type": "LONGINTEGER",
"label": "Pipeline Id",
"description": "Identifier for the pipeline in which the finding was detected"
},
{
"column_name": "attestation_id",
"type": "LONGINTEGER",
"label": "Evidence ID",
"description": "The source attestation for this data. This ID can be used to retrieve the attestation or its metadata"
},
{
"column_name": "component_name",
"type": "STRING",
"label": "Dependency",
"description": "The name of the component to which the finding belongs"
},
{
"column_name": "logical_app",
"type": "STRING",
"label": "Product",
"description": "Product name"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "attack_vector",
"type": "",
"label": "Attack Vector",
"description": "A column calculated by looking at the attack vector component of the cvss vector and assigns a rating. (e.g /AV:N is assigned Network for the attack vector being the network)"
},
{
"column_name": "Severity",
"type": "",
"label": "Severity",
"description": "A caluclated column that creates a div containing an image depicting the severity of the finding"
},
{
"column_name": "availability_impact",
"type": "",
"label": "Availability Impact",
"description": "A column calculated by looking at the availability impact component of the cvss vector and assigns a rating. (e.g '/A:L' is assigned Low for a Low availability impact)"
},
{
"column_name": "confidentiality_impact",
"type": "",
"label": "Confidentiality Impact",
"description": "A column calculated by looking at the confidentiality impact component of the cvss vector and assigns a rating. (e.g '/C:L' is assigned Low for a Low confidentiality impact)"
},
{
"column_name": "integrity_impact",
"type": "",
"label": "Integrity Impact",
"description": "A column calculated by looking at the intergity component of the cvss vector and assigns an impact rating. E.g ( /I:H is assingned High for a high intergity impact)"
},
{
"column_name": "attack_complexity",
"type": "",
"label": "Attack Complexity",
"description": "A column calculated by looking at the attack complexity component of the cvss vector and assigns a rating. (e.g /AC:L is assigned High for a High attack complexity)"
}
],
"md": "## `Findings` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `line` | Line | INTEGER | line number in the source file or codebase where the vulnerability or issue was found | True |\n| `file_path` | Path | STRING | The source code file/ configuration file/ component name or artifact/ path in a container or image in which the issue exists | True |\n| `description` | Description | STRING | A description of the finding | True |\n| `title` | Title | STRING | The title of the finding | True |\n| `parser` | Parser | STRING | The tool used to generate the attestation | True |\n| `targetName` | Component | STRING | The name of the attestation uploaded | True |\n| `logical_app_version` | Version | STRING | Version of the product | True |\n| `context` | Context | JSONB | The context of the attestation | True |\n| `original_attestation_id` | Original Attestation Id | LONGINTEGER | The id of the attestation which is uploaded to be converted | True |\n| `severity_string` | Severity | STRING | severity of the cve as a single word | True |\n| `finding` | Finding | JSONB | A raw json record of the finding | True |\n| `severity` | Severity | INTEGER | The severity of the finding which corresponds to the severity string (e.g 4) | True |\n| `more` | | | A column showing more details about the finding | True |\n| `cvssv3` | CVSSv3 | STRING | The cvss vector for the finding | True |\n| `created` | Created | DATETIMETZ | Timestamp of when the record was inserted into the databse | True |\n| `cwe_id` | CWE | STRING | The CWE ID for associated with the finding | True |\n| `id` | ID | LONGINTEGER | the table id of the finding | True |\n| `main_tool` | Tool | STRING | The tool used to create the attestation | True |\n| `severity_order` | Severity Order | STRING | Assigns a ranking to the severity. e,g (0-Critical, 1-High) | True |\n| `product_id` | Product Id | LONGINTEGER | Unique identifier for the product associated with the finding | True |\n| `pipeline_id` | Pipeline Id | LONGINTEGER | Identifier for the pipeline in which the finding was detected | True |\n| `attestation_id` | Evidence ID | LONGINTEGER | The source attestation for this data. This ID can be used to retrieve the attestation or its metadata | True |\n| `component_name` | Dependency | STRING | The name of the component to which the finding belongs | True |\n| `logical_app` | Product | STRING | Product name | True |\n| `teamId` | Teamid | LONGINTEGER | Scribe teamID (required for RLS) | True |\n| `attack_vector` | Attack Vector | | A column calculated by looking at the attack vector component of the cvss vector and assigns a rating. (e.g /AV:N is assigned Network for the attack vector being the network) | True |\n| `Severity` | Severity | | A caluclated column that creates a div containing an image depicting the severity of the finding | True |\n| `availability_impact` | Availability Impact | | A column calculated by looking at the availability impact component of the cvss vector and assigns a rating. (e.g '/A:L' is assigned Low for a Low availability impact) | True |\n| `confidentiality_impact` | Confidentiality Impact | | A column calculated by looking at the confidentiality impact component of the cvss vector and assigns a rating. (e.g '/C:L' is assigned Low for a Low confidentiality impact) | True |\n| `integrity_impact` | Integrity Impact | | A column calculated by looking at the intergity component of the cvss vector and assigns an impact rating. E.g ( /I:H is assingned High for a high intergity impact) | True |\n| `attack_complexity` | Attack Complexity | | A column calculated by looking at the attack complexity component of the cvss vector and assigns a rating. (e.g /AC:L is assigned High for a High attack complexity) | True |\n\n"
},
"MARKETING Team activity": {
"columns": [
{
"column_name": "teamName",
"type": "STRING",
"label": "Team name",
"description": "Human-readable name of the team"
},
{
"column_name": "lastAccess",
"type": "DATETIMETZ",
"label": "Lastaccess",
"description": "Timestamp of the most recent system access by any team member"
},
{
"column_name": "autoProvisioningCustomerSource",
"type": "STRING",
"label": "Provisioned-by",
"description": "Identifies the source system or method used to automatically provision customers"
},
{
"column_name": "created",
"type": "DATETIMETZ",
"label": "Created",
"description": "Timestamp when the first member joined the team [Check]"
},
{
"column_name": "date",
"type": "DATE",
"label": "Date",
"description": "Activity date for the recorded metrics"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "attestations",
"type": "LONGINTEGER",
"label": "Attestations",
"description": "Number of uploaded evidences per date"
},
{
"column_name": "invites",
"type": "LONGINTEGER",
"label": "Invites",
"description": "Number of invitations sent by the team per date"
},
{
"column_name": "versions",
"type": "LONGINTEGER",
"label": "Versions",
"description": "Number of product versions in the team per date"
},
{
"column_name": "hubspotEmail",
"type": "STRING",
"label": "Hubspotemail",
"description": "Email address used for HubSpot CRM integration"
},
{
"column_name": "lead",
"type": "STRING",
"label": "Lead",
"description": "Name of the first team member [Check]"
},
{
"column_name": "email",
"type": "STRING",
"label": "Email",
"description": "Email of the first team member [Check]"
}
],
"md": "## `MARKETING Team activity` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `teamName` | Team name | STRING | Human-readable name of the team | True |\n| `lastAccess` | Lastaccess | DATETIMETZ | Timestamp of the most recent system access by any team member | True |\n| `autoProvisioningCustomerSource` | Provisioned-by | STRING | Identifies the source system or method used to automatically provision customers | True |\n| `created` | Created | DATETIMETZ | Timestamp when the first member joined the team [Check] | True |\n| `date` | Date | DATE | Activity date for the recorded metrics | True |\n| `teamId` | Teamid | LONGINTEGER | Scribe teamID (required for RLS) | True |\n| `attestations` | Attestations | LONGINTEGER | Number of uploaded evidences per date | True |\n| `invites` | Invites | LONGINTEGER | Number of invitations sent by the team per date | True |\n| `versions` | Versions | LONGINTEGER | Number of product versions in the team per date | True |\n| `hubspotEmail` | Hubspotemail | STRING | Email address used for HubSpot CRM integration | True |\n| `lead` | Lead | STRING | Name of the first team member [Check] | True |\n| `email` | Email | STRING | Email of the first team member [Check] | True |\n\n"
},
"product_risk_1.0": {
"columns": [
{
"column_name": "target_cves_in_base_image",
"type": "LONGINTEGER",
"label": "Target Cves In Base Image",
"description": "Number of CVEs in Component Base Image"
},
{
"column_name": "total_completion",
"type": "",
"label": "Safe",
"description": ""
},
{
"column_name": "target_fixables",
"type": "LONGINTEGER",
"label": "Target Fixables",
"description": "Number of fixable risky CVEs of the component"
},
{
"column_name": "weighted_cve_risk",
"type": "DECIMAL",
"label": "Weighted Cve Risk",
"description": "Risk imposed by the CVE, taking into account weights (business criticality, public facing, publicly available)"
},
{
"column_name": "target_risk",
"type": "DECIMAL",
"label": "Component Risk",
"description": "Total risk for this component of the product"
},
{
"column_name": "has_fix",
"type": "BOOLEAN",
"label": "Has Fix",
"description": "True if there is a fix for this vulnerability (usually an udate for the vulnerable dependency)"
},
{
"column_name": "in_base_image",
"type": "BOOLEAN",
"label": "In Base Image",
"description": "True if the vulnerability is in the base layer of a Docker image"
},
{
"column_name": "target",
"type": "STRING",
"label": "Component",
"description": "The component (usually a Docker image name:tag)"
},
{
"column_name": "vulnerability_id",
"type": "STRING",
"label": "CVE ID",
"description": "CVE ID for this line"
},
{
"column_name": "target_badges",
"type": "STRING",
"label": "Info",
"description": ""
},
{
"column_name": "logical_app_version_cves_in_base_image",
"type": "DECIMAL",
"label": "Logical App Version Cves In Base Image",
"description": "Total CVEs in base image for this product version"
},
{
"column_name": "logical_app_version",
"type": "STRING",
"label": "Version",
"description": "Version of Product in ScribeHub"
},
{
"column_name": "logical_app",
"type": "STRING",
"label": "Product",
"description": "Name of Product in ScribeHub. A product is made of components (e.g. a few docker images)"
},
{
"column_name": "logical_app_version_exploitables",
"type": "DECIMAL",
"label": "Logical App Version Exploitables",
"description": "Number of exploitable CVEs in the Product-Version"
},
{
"column_name": "logical_app_version_fixables",
"type": "DECIMAL",
"label": "Logical App Version Fixables",
"description": "Number of Fixable CVEs in the product-version"
},
{
"column_name": "weight",
"type": "FLOAT",
"label": "Weight",
"description": "the is the accumulated weight for this Componen (Target)"
},
{
"column_name": "logical_app_version_risk",
"type": "DECIMAL",
"label": "Product Risk",
"description": "Total risk for this Product Version"
},
{
"column_name": "has_kev",
"type": "BOOLEAN",
"label": "Has Kev",
"description": "True if this CVE is a Known Exploitable Vulnerability"
},
{
"column_name": "target_exploitables",
"type": "LONGINTEGER",
"label": "Target Exploitables",
"description": "Number of Exploitable CVEs in the component"
},
{
"column_name": "num_targets",
"type": "LONGINTEGER",
"label": "Num Targets",
"description": "Number of Components in the Product"
},
{
"column_name": "logical_app_badges",
"type": "STRING",
"label": "Info",
"description": ""
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "ID of the team within Scribe"
},
{
"column_name": "total_risk",
"type": "DECIMAL",
"label": "Total Risk",
"description": "Total risk for this team (across all product-versions)"
},
{
"column_name": "total_exploitables",
"type": "DECIMAL",
"label": "Total Exploitables",
"description": "Total number of exploitable CVEs in the team"
},
{
"column_name": "total_fixables",
"type": "DECIMAL",
"label": "Total Fixables",
"description": "Total number of CVEs with a fix in the team"
},
{
"column_name": "total_cves_in_base_image",
"type": "DECIMAL",
"label": "Total Cves In Base Image",
"description": "Total number of CVEs that are in a base image, across the team"
},
{
"column_name": "totals_badge",
"type": "STRING",
"label": "Totals",
"description": ""
},
{
"column_name": "cve_badges",
"type": "STRING",
"label": "Info",
"description": ""
}
],
"md": "## `product_risk_1.0` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `target_cves_in_base_image` | Target Cves In Base Image | LONGINTEGER | Number of CVEs in Component Base Image | True |\n| `total_completion` | Safe | | | True |\n| `target_fixables` | Target Fixables | LONGINTEGER | Number of fixable risky CVEs of the component | True |\n| `weighted_cve_risk` | Weighted Cve Risk | DECIMAL | Risk imposed by the CVE, taking into account weights (business criticality, public facing, publicly available) | True |\n| `target_risk` | Component Risk | DECIMAL | Total risk for this component of the product | True |\n| `has_fix` | Has Fix | BOOLEAN | True if there is a fix for this vulnerability (usually an udate for the vulnerable dependency) | True |\n| `in_base_image` | In Base Image | BOOLEAN | True if the vulnerability is in the base layer of a Docker image | True |\n| `target` | Component | STRING | The component (usually a Docker image name:tag) | True |\n| `vulnerability_id` | CVE ID | STRING | CVE ID for this line | True |\n| `target_badges` | Info | STRING | | True |\n| `logical_app_version_cves_in_base_image` | Logical App Version Cves In Base Image | DECIMAL | Total CVEs in base image for this product version | True |\n| `logical_app_version` | Version | STRING | Version of Product in ScribeHub | True |\n| `logical_app` | Product | STRING | Name of Product in ScribeHub. A product is made of components (e.g. a few docker images) | True |\n| `logical_app_version_exploitables` | Logical App Version Exploitables | DECIMAL | Number of exploitable CVEs in the Product-Version | True |\n| `logical_app_version_fixables` | Logical App Version Fixables | DECIMAL | Number of Fixable CVEs in the product-version | True |\n| `weight` | Weight | FLOAT | the is the accumulated weight for this Componen (Target) | True |\n| `logical_app_version_risk` | Product Risk | DECIMAL | Total risk for this Product Version | True |\n| `has_kev` | Has Kev | BOOLEAN | True if this CVE is a Known Exploitable Vulnerability | True |\n| `target_exploitables` | Target Exploitables | LONGINTEGER | Number of Exploitable CVEs in the component | True |\n| `num_targets` | Num Targets | LONGINTEGER | Number of Components in the Product | True |\n| `logical_app_badges` | Info | STRING | | True |\n| `teamId` | Teamid | LONGINTEGER | ID of the team within Scribe | True |\n| `total_risk` | Total Risk | DECIMAL | Total risk for this team (across all product-versions) | True |\n| `total_exploitables` | Total Exploitables | DECIMAL | Total number of exploitable CVEs in the team | True |\n| `total_fixables` | Total Fixables | DECIMAL | Total number of CVEs with a fix in the team | True |\n| `total_cves_in_base_image` | Total Cves In Base Image | DECIMAL | Total number of CVEs that are in a base image, across the team | True |\n| `totals_badge` | Totals | STRING | | True |\n| `cve_badges` | Info | STRING | | True |\n\n"
},
"endoflife_250326": {
"columns": [
{
"column_name": "link",
"type": "STRING",
"label": "Info URL",
"description": "URL where end of life info can be found"
},
{
"column_name": "releaseDate",
"type": "DATETIMETZ",
"label": "Release Date",
"description": "Date of release of the product"
},
{
"column_name": "support",
"type": "DATETIMETZ",
"label": "Support Date",
"description": "Last support date, usually not supplied"
},
{
"column_name": "lts",
"type": "DATETIMETZ",
"label": "LTS Date",
"description": "LTS date: The last date until which a product is guaranteed extended support."
},
{
"column_name": "eol",
"type": "DATETIMETZ",
"label": "EOL Date",
"description": "EOL date: The date after which a product is considered unsupported."
},
{
"column_name": "latest",
"type": "STRING",
"label": "Latest Version",
"description": "The latest version of the product"
},
{
"column_name": "cycle",
"type": "STRING",
"label": "Cycle",
"description": "A cycle groups related version (e.g. all 7.x.x) versions"
},
{
"column_name": "product",
"type": "STRING",
"label": "Product",
"description": "The (commercial) product"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
}
],
"md": "## `endoflife_250326` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `link` | Info URL | STRING | URL where end of life info can be found | True |\n| `releaseDate` | Release Date | DATETIMETZ | Date of release of the product | True |\n| `support` | Support Date | DATETIMETZ | Last support date, usually not supplied | True |\n| `lts` | LTS Date | DATETIMETZ | LTS date: The last date until which a product is guaranteed extended support. | True |\n| `eol` | EOL Date | DATETIMETZ | EOL date: The date after which a product is considered unsupported. | True |\n| `latest` | Latest Version | STRING | The latest version of the product | True |\n| `cycle` | Cycle | STRING | A cycle groups related version (e.g. all 7.x.x) versions | True |\n| `product` | Product | STRING | The (commercial) product | True |\n| `teamId` | Teamid | LONGINTEGER | Scribe teamID (required for RLS) | True |\n\n"
},
"extended_lineage_new": {
"columns": [
{
"column_name": "platform_type",
"type": "STRING",
"label": "Platform Type",
"description": "The type of platform to which the asset belongs (e.g SCM)"
},
{
"column_name": "properties",
"type": "JSONB",
"label": "Info",
"description": "A raw json of the asset record from the attestation"
},
{
"column_name": "version_id",
"type": "LONGINTEGER",
"label": "Version Id",
"description": "Table ID of the version"
},
{
"column_name": "product_id",
"type": "LONGINTEGER",
"label": "Product ID",
"description": "Table ID of the product"
},
{
"column_name": "parent_name",
"type": "STRING",
"label": "Parent Name",
"description": "The asset name of the parent asset"
},
{
"column_name": "parent_type",
"type": "STRING",
"label": "Parent Type",
"description": "The asset type of the parent asset"
},
{
"column_name": "asset_name",
"type": "STRING",
"label": "Asset",
"description": "The name of the asset"
},
{
"column_name": "path",
"type": "STRING",
"label": "Path",
"description": "A url/location of where to find the asset"
},
{
"column_name": "parent_id",
"type": "LONGINTEGER",
"label": "Parent Id",
"description": "The table id of the parent asset"
},
{
"column_name": "child_id",
"type": "LONGINTEGER",
"label": "Child Id",
"description": "The table id of the child asset"
},
{
"column_name": "teamId",
"type": "INTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "owner",
"type": "STRING",
"label": "Owner",
"description": "Not Applicable"
},
{
"column_name": "platform_name",
"type": "STRING",
"label": "Platform",
"description": "Name of the platform to which an asset belongs (e.g Github)"
},
{
"column_name": "asset_type",
"type": "STRING",
"label": "Type",
"description": "The type of asset (e.g image)"
},
{
"column_name": "external_id",
"type": "STRING",
"label": "External ID",
"description": "Asset identifier as extracted from the relevant api or calculated"
},
{
"column_name": "timestamp",
"type": "DATETIME",
"label": "Updated",
"description": "Timestamp of when the asset was inserted into the table"
},
{
"column_name": "uri",
"type": "STRING",
"label": "URI",
"description": "URL of the asset"
},
{
"column_name": "prent_bloack",
"type": "",
"label": "Parent",
"description": ""
},
{
"column_name": "more",
"type": "",
"label": " More",
"description": ""
},
{
"column_name": "tooltip",
"type": "STRING",
"label": "Tooltip",
"description": "Pop up showing field showing asset name when hovering"
},
{
"column_name": "parent_external_id",
"type": "STRING",
"label": "Parent External ID",
"description": "Asset identifier as extracted from the relevant api or calculated for the parent of the asset"
},
{
"column_name": "logical_app",
"type": "STRING",
"label": "Product",
"description": "Product name"
},
{
"column_name": "logical_app_version",
"type": "STRING",
"label": "Version",
"description": "Version of the product"
},
{
"column_name": "asset_block",
"type": "",
"label": "Asset",
"description": ""
},
{
"column_name": "g-source",
"type": "STRING",
"label": "G-Source",
"description": "The source of the asset ( the assets parents external id combined with the parent assets type)"
},
{
"column_name": "g-target",
"type": "STRING",
"label": "G-Target",
"description": "The target asset ( the assets external id combined with the assets type)"
}
],
"md": "## `extended_lineage_new` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `platform_type` | Platform Type | STRING | The type of platform to which the asset belongs (e.g SCM) | True |\n| `properties` | Info | JSONB | A raw json of the asset record from the attestation | True |\n| `version_id` | Version Id | LONGINTEGER | Table ID of the version | True |\n| `product_id` | Product ID | LONGINTEGER | Table ID of the product | True |\n| `parent_name` | Parent Name | STRING | The asset name of the parent asset | True |\n| `parent_type` | Parent Type | STRING | The asset type of the parent asset | True |\n| `asset_name` | Asset | STRING | The name of the asset | True |\n| `path` | Path | STRING | A url/location of where to find the asset | True |\n| `parent_id` | Parent Id | LONGINTEGER | The table id of the parent asset | True |\n| `child_id` | Child Id | LONGINTEGER | The table id of the child asset | True |\n| `teamId` | Teamid | INTEGER | Scribe teamID (required for RLS) | True |\n| `owner` | Owner | STRING | Not Applicable | True |\n| `platform_name` | Platform | STRING | Name of the platform to which an asset belongs (e.g Github) | True |\n| `asset_type` | Type | STRING | The type of asset (e.g image) | True |\n| `external_id` | External ID | STRING | Asset identifier as extracted from the relevant api or calculated | True |\n| `timestamp` | Updated | DATETIME | Timestamp of when the asset was inserted into the table | True |\n| `uri` | URI | STRING | URL of the asset | True |\n| `prent_bloack` | Parent | | | True |\n| `more` | More | | | True |\n| `tooltip` | Tooltip | STRING | Pop up showing field showing asset name when hovering | True |\n| `parent_external_id` | Parent External ID | STRING | Asset identifier as extracted from the relevant api or calculated for the parent of the asset | True |\n| `logical_app` | Product | STRING | Product name | True |\n| `logical_app_version` | Version | STRING | Version of the product | True |\n| `asset_block` | Asset | | | True |\n| `g-source` | G-Source | STRING | The source of the asset ( the assets parents external id combined with the parent assets type) | True |\n| `g-target` | G-Target | STRING | The target asset ( the assets external id combined with the assets type) | True |\n\n"
},
"API Attestations": {
"columns": [
{
"column_name": "published",
"type": "BOOLEAN",
"label": "Published",
"description": "True if the product has been published"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "attestation_id",
"type": "LONGINTEGER",
"label": "Attestation Id",
"description": "The source attestation for this data. This ID can be used to retrieve the attestation or its metadata"
},
{
"column_name": "version_rank",
"type": "LONGINTEGER",
"label": "Version Rank",
"description": "The ranking of the logical_app_version among all versions"
},
{
"column_name": "contentType",
"type": "STRING",
"label": "Contenttype",
"description": "The type of the content of the attestation; enables parsing accordingly"
},
{
"column_name": "logical_app",
"type": "STRING",
"label": "Product",
"description": "Product name"
},
{
"column_name": "deleted",
"type": "BOOLEAN",
"label": "Deleted",
"description": "True if deleted (the file exists)"
},
{
"column_name": "attestation_timestamp",
"type": "DATETIMETZ",
"label": "Attestation Timestamp",
"description": "Attestation creation timestamp"
},
{
"column_name": "context_elements",
"type": "JSONB",
"label": "Context Elements",
"description": "[check]"
},
{
"column_name": "context",
"type": "JSONB",
"label": "Context",
"description": "JSONB object with information about the context of the evidence creation (pipeline run, job name, host name and many more items, dev-platform dependant)"
},
{
"column_name": "targetName",
"type": "STRING",
"label": "Targetname",
"description": "The name of the subject of the attestation for example image or git repo name, file name"
},
{
"column_name": "sigStatus",
"type": "STRING",
"label": "Sigstatus",
"description": "Signature verification status of the attestation (verified, unverified, unsigned)"
},
{
"column_name": "targetType",
"type": "STRING",
"label": "Targettype",
"description": "Type of the target: image, git, dir, file, data"
},
{
"column_name": "contextType",
"type": "STRING",
"label": "Contexttype",
"description": "Type of the context - related to the dev platform (github, gitlab, jenkins etc.)"
},
{
"column_name": "job_name",
"type": "STRING",
"label": "Job Name",
"description": "The CI job name where the attestation was taken"
},
{
"column_name": "run_id",
"type": "STRING",
"label": "Run Id",
"description": "The pipeline run ID [check]"
},
{
"column_name": "license",
"type": "STRING",
"label": "License",
"description": "[check]"
},
{
"column_name": "logical_app_version",
"type": "STRING",
"label": "Version",
"description": "Version of the product"
},
{
"column_name": "deeplink",
"type": "STRING",
"label": "Deeplink",
"description": "A deep link to ScribeHub, example: /producer-products/details/7479/versions/48714/image/108579 (note you can extract from there the product internal id - 7479 and the version id - 48714)"
},
{
"column_name": "image_id",
"type": "STRING",
"label": "Image Id",
"description": "In case of a target of type image, the hash of the image in format sha256:123FD... can be used to match targets."
}
],
"md": "## `API Attestations` Columns\n\n| Column Name | Label | Type | Description | Like-compliant |\n|-------------|-------|------|-------------|----------------|\n| `published` | Published | BOOLEAN | True if the product has been published | True |\n| `teamId` | Teamid | LONGINTEGER | Scribe teamID (required for RLS) | True |\n| `attestation_id` | Attestation Id | LONGINTEGER | The source attestation for this data. This ID can be used to retrieve the attestation or its metadata | True |\n| `version_rank` | Version Rank | LONGINTEGER | The ranking of the logical_app_version among all versions | True |\n| `contentType` | Contenttype | STRING | The type of the content of the attestation; enables parsing accordingly | True |\n| `logical_app` | Product | STRING | Product name | True |\n| `deleted` | Deleted | BOOLEAN | True if deleted (the file exists) | True |\n| `attestation_timestamp` | Attestation Timestamp | DATETIMETZ | Attestation creation timestamp | True |\n| `context_elements` | Context Elements | JSONB | [check] | True |\n| `context` | Context | JSONB | JSONB object with information about the context of the evidence creation (pipeline run, job name, host name and many more items, dev-platform dependant) | True |\n| `targetName` | Targetname | STRING | The name of the subject of the attestation for example image or git repo name, file name | True |\n| `sigStatus` | Sigstatus | STRING | Signature verification status of the attestation (verified, unverified, unsigned) | True |\n| `targetType` | Targettype | STRING | Type of the target: image, git, dir, file, data | True |\n| `contextType` | Contexttype | STRING | Type of the context - related to the dev platform (github, gitlab, jenkins etc.) | True |\n| `job_name` | Job Name | STRING | The CI job name where the attestation was taken | True |\n| `run_id` | Run Id | STRING | The pipeline run ID [check] | True |\n| `license` | License | STRING | [check] | True |\n| `logical_app_version` | Version | STRING | Version of the product | True |\n| `deeplink` | Deeplink | STRING | A deep link to ScribeHub, example: /producer-products/details/7479/versions/48714/image/108579 (note you can extract from there the product internal id - 7479 and the version id - 48714) | True |\n| `image_id` | Image Id | STRING | In case of a target of type image, the hash of the image in format sha256:123FD... can be used to match targets. | True |\n\n"
}
}
{
"API Vulnerabilities": {
"columns": [
{
"column_name": "component_id",
"type": "LONGINTEGER",
"label": "Dependency ID",
"description": "The id of the component/dependency that the vulnerability affects"
},
{
"column_name": "vulnerability_id",
"type": "STRING",
"label": "ID",
"description": "the id of the vulnerability"
},
{
"column_name": "vector",
"type": "STRING",
"label": "Vector",
"description": "The cvss vector of the vulnerability"
},
{
"column_name": "severity_string",
"type": "STRING",
"label": "Severity String",
"description": "severity string of the vulnerability (e.g Medium)"
},
{
"column_name": "base_severity_string",
"type": "STRING",
"label": "Base Severity String",
"description": "Text representation of the base severity level of the vulnerability"
},
{
"column_name": "advisory_status",
"type": "STRING",
"label": "Advisory Status",
"description": "current status of the advisory related to the vulnerability (e.g. draft, published, approved, rejected)"
},
{
"column_name": "final_severity",
"type": "INTEGER",
"label": "Final Severity",
"description": "0 if a user/3rd part advisory that lowers the severity, if not lowered then its the severity of the vulnerability"
},
{
"column_name": "tool",
"type": "STRING",
"label": "Tool",
"description": "The tool that found the vulnerability"
},
{
"column_name": "teamId",
"type": "LONGINTEGER",
"label": "Teamid",
"description": "Scribe teamID (required for RLS)"
},
{
"column_name": "pipeline_run_id",
"type": "LONGINTEGER",
"label": "Pipeline Run Id",
"description": "Version(pipeline run) id that contains the vulnerability"
},
{
"column_name": "pkg",
"type": "STRING",
"label": "Pkg",
"description": "The package manager of the dependency that contains the vulnerability"
},
{
"column_name": "latest_package_version",
"type": "STRING",
"label": "Dependency Latest Version",
"description": "The latest known versison of the dependency"
},
{
"column_name": "attestation_ids",
"type": "LONGINTEGERARRAY",
"label": "Attestation IDs",
"description": "The ids of the attestations in which the vulnerability was found"
},
{
"column_name": "cvss_score",
"type": "FLOAT",
"label": "CVSS",
"description": "The cvss score of the vulnerability"
},
{
"column_name": "logical_app",
"type": "STRING",
"label": "Product",
"description": "Product name"
},
{
"column_name": "vul_component_fixed_in_versions",
"type": "STRINGARRAY",
"label": "Vulnerability Fix Version",
"description": "The versions of the component in which the vulnerability as fixed"
},
{