CVSS Score

cvss

The Common Vulnerability Scoring System (CVSS) object provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity.

Contents

Attributes

Caption Name Type Is Array Default Description
Access Complexity (AC) access_complexity_id Integer Name: Access Complexity (AC). Group: Base. CVSS Version: v1, v2

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Low (L)
1
Medium (M)
2
High (H)
Access Vector (AV) access_vector_id Integer Name: Access Vector (AV). Group: Base. CVSS version: v1, v2

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Local (L)
1
Adjacent Network (A)
2
Network (N)
Attack Complexity (AC) attack_complexity_id Integer The Attack Complexity Common Vulnerability Scoring System (CVSS) metric. Name: Attack Complexity (AC). Group: Base. CVSS version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Low (L)
1
High (H)
Attack Vector (AV) attack_vector_id Integer Name: Attack Vector (AV). Group: Base. CVSS version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Network (N)
1
Adjacent (A)
2
Local (L)
3
Physical (P)
Authentication (Au) authentication_id Integer Name: Authentication (Au). Group: Base. CVSS version: v1, v2

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
None
1
Single (S)
2
Multiple (M)
Availability (A) availability_id Integer Name: Availability (A). Group: Base. CVSS version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
None (N)
1
Low (L)
2
High (H)
Availability Impact (A) availability_impact_id Integer Name: Availability Impact (A). Group: Base, CVSS version: v1, v2

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
None (N)
1
Partial (P)
2
Complete (C)
Availability Requirement (AR) availability_requirement_id Integer Name: Availability Requirement (AR). Group: Environmental. CVSS version: v2, v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X, ND)
1
Low (L)
2
Medium (LM)
3
High (H)
Base Score base_score Float The CVSS base score. For example: 9.1.
Collateral Damage Potential (CDP) collateral_damage_potential_id Integer Name: Collateral Damage Potential (CDP). Group: Environmental. CVSS version: v1, v2

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
None (N)
1
Low (L)
2
Low-Medium (LM)
3
Medium-High (MH)
4
High (H)
5
Not Defined (ND)
Confidentiality (C) confidentiality_id Integer The Confidentiality Common Vulnerability Scoring System (CVSS) metric. Name: Confidentiality (C). Group: Base. CVSS version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

-1
Other
0
None (N)
1
Low (L)
2
High (H)
3
Secret
4
Top Secret
5
Private
6
Restricted
99
Other
Confidentiality Impact (C) confidentiality_impact_id Integer Name: Confidentiality Impact (C). Group: Base CVSS version: v1, v2

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
None (N)
1
Partial (P)
2
Complete (C)
Confidentiality Requirement (CR) confidentiality_requirement_id Integer Name: Confidentiality Requirement (CR). Group: Environmental. CVSS version: v2, v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X, ND)
1
Low (L)
2
Medium (LM)
3
High (H)
CVSS Depth depth String The CVSS depth represents a depth of the equation used to calculate CVSS score.
Base
Base
Environmental
Environmental
Temporal
Temporal
CVSS Depth depth_id Integer The CVSS depth. Representing a depth of the equation used to calculate CVSS score.

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Base
1
Temporal
2
Environmental
Exploit Code Maturity (E) exploit_code_maturity_id Integer Name: Exploit Code Maturity (E). Group: Temporal. CVSS version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X)
1
High (H)
2
Functional (F)
3
Proof-of-Concept (P)
4
Unproven (U)
Exploitability (E) exploitability_id Integer Name: Exploitability (E). Group: Temporal. CVSS version: v1, v2

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (ND)
1
High (H)
2
Functional (F)
3
Proof-of-Concept (POC)
4
Unproven (U)
Integrity (I) integrity_id Integer The Integrity Common Vulnerability Scoring System (CVSS) metric. Name: Integrity (I). Group: Base. CVSS version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
None (N)
1
Low (L)
2
High (H)
3
Medium
4
High
5
System
6
Protected
99
Other
Integrity Impact (I) integrity_impact_id Integer Name: Integrity Impact (I). Group: Base. CVSS version: v1, v2

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
None (N)
1
Partial (P)
2
Complete (C)
Integrity Requirement (IR) integrity_requirement_id Integer Name: Integrity Requirement (IR). Group: Environmental. CVSS version: v2, v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X, ND)
1
Low (L)
2
Medium (LM)
3
High (H)
Metrics metrics Metric The Common Vulnerability Scoring System metrics. This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: { {"Access Vector", "Network"}, {"Access Complexity", "Low"}, ...}.
Modified Attack Complexity (MAC) modified_attack_complexity_id Integer Name: Modified Attack Complexity (MAC). Group: Environmental. Version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X)
1
Low (L)
2
High (H)
Modified Attack Vector (MAV) modified_attack_vector_id Integer Name: Modified Attack Vector (MAV). Group: Environmental. Version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X)
1
Network (N)
2
Adjacent (A)
3
Local (L)
4
Physical (P)
Modified Availability (MA) modified_availability_id Integer Name: Modified Availability (MA). Group: Environmental. Version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X)
1
None (N)
2
Low (L)
3
High (H)
Modified Confidentiality (MC) modified_confidentiality_id Integer Name: Modified Confidentiality (MC). Group: Environmental. Version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X)
1
None (N)
2
Low (L)
3
High (H)
Modified Integrity (MI) modified_integrity_id Integer Name: Modified Integrity (MI). Group: Environmental. Version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X)
1
None (N)
2
Low (L)
3
High (H)
Modified Privileges Required (MPR) modified_privileges_required_id Integer Name: Modified Privileges Required (MPR). Group: Environmental. Version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X)
1
None (N)
2
Low (L)
3
High (H)
Modified Scope (MS) modified_scope_id Integer Name: Modified Scope (MS). Group: Environmental. Version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X)
1
Unchanged (U)
2
Changed (C)
Modified User Interaction (MUI) modified_user_interaction_id Integer Name: Modified User Interaction (MUI). Group: Environmental. Version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X)
1
None (N)
2
Required (R)
Overall Score overall_score Float The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1.
Privileges Required (PR) privileges_required_id Integer The Privileges Required (PR) Common Vulnerability Scoring System (CVSS) metric. Name: Privileges Required (PR). Group: Base. CVSS version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
None (N)
1
Low (L)
2
High (H)
Raw Data raw_data JSON The event data as received from the event source.
Reputation Score raw_score Float CVSS Score in the range of 0.0 to 10.0.

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

Record ID record_id String Unique identifier for the object
Remediation Level (RL) remediation_level_id Integer Name: Remediation Level (RL). Group: Temporal. CVSS version: v1, v2, v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X, ND)
1
Unavailable (U)
2
Workaround (W)
3
Temporary Fix (T, TF)
4
Official Fix (O, OF)
Report Confidence (RC) report_confidence_id Integer Name: Report Confidence (RC). Group: Temporal. CVSS version: v1, v2, v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Not Defined (X, ND)
1
Confirmed (C)
2
Reasonable (R)
3
Unconfirmed (UC)
4
Uncorroborated (UR)
5
Unknown (U)
Scope (S) scope_id Integer Name: Scope (S). Group: Base. CVSS version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
Unchanged (U)
1
Changed (C)
Severity severity String

The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.

CVSS v2.0
  • Low (0.0 – 3.9)
  • Medium (4.0 – 6.9)
  • High (7.0 – 10.0)

CVSS v3.0
  • None (0.0)
  • Low (0.1 - 3.9)
  • Medium (4.0 - 6.9)
  • High (7.0 - 8.9)
  • Critical (9.0 - 10.0)
Qualitative Severity Rating severity_id Integer The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score. None (0.0), Low (0.1 - 3.9), Medium (4.0 - 6.9), High (7.0 - 8.9), Critical (9.0 - 10.0)

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

-1
Other
0
None
1
Low
2
Medium
3
High
4
Critical
5
Critical
6
Fatal
99
Other
Target Distribution (TD) target_distribution_id Integer Name: Target Distribution (TD). Group: Environmental. CVSS version: v1, v2

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
None (N)
1
Low (L)
2
Medium (LM)
3
High (H)
4
Not Defined (ND)
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.
User Interaction (UI) user_interaction_id Integer The User Interaction Common Vulnerability Scoring System (CVSS) metric. Name: User Interaction (UI). Group: Base. CVSS version: v3

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

0
None (N)
1
Required (R)
Vector String vector_string String The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.
Version version String The CVSS version. For example: 3.1.

References

Referenced By

Context

CVSS Score

JSON

            
{
  "caption": "CVSS Score",
  "description": "The Common Vulnerability Scoring System (<a target='_blank' href='https://www.first.org/cvss/'>CVSS</a>) object provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity.",
  "extends": "object",
  "name": "cvss",
  "attributes": {
    "base_score": {
      "description": "The CVSS base score. For example: <code>9.1</code>.",
      "requirement": "required",
      "caption": "Base Score",
      "type": "float_t"
    },
    "depth": {
      "requirement": "recommended",
      "caption": "CVSS Depth",
      "description": "The CVSS depth represents a depth of the equation used to calculate CVSS score.",
      "type": "string_t",
      "enum": {
        "Base": {
          "caption": "Base"
        },
        "Environmental": {
          "caption": "Environmental"
        },
        "Temporal": {
          "caption": "Temporal"
        }
      }
    },
    "metrics": {
      "description": "The Common Vulnerability Scoring System metrics. This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: <code>{ {\"Access Vector\", \"Network\"}, {\"Access Complexity\", \"Low\"}, ...}</code>.",
      "requirement": "optional",
      "caption": "Metrics",
      "type": "metric",
      "is_array": true
    },
    "overall_score": {
      "description": "The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: <code>9.1</code>.",
      "requirement": "recommended",
      "caption": "Overall Score",
      "type": "float_t"
    },
    "severity": {
      "description": "<p>The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 \u2013 3.9)</li><li>Medium (4.0 \u2013 6.9)</li><li>High (7.0 \u2013 10.0)</li></ul></p><strong>CVSS v3.0</strong><ul><li>None (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 - 6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 - 10.0)</li></ul>",
      "requirement": "optional",
      "caption": "Severity",
      "type": "string_t"
    },
    "vector_string": {
      "requirement": "optional",
      "caption": "Vector String",
      "description": "The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.",
      "type": "string_t"
    },
    "version": {
      "description": "The CVSS version. For example: <code>3.1</code>.",
      "requirement": "required",
      "caption": "Version",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    },
    "integrity_id": {
      "description": "The Integrity Common Vulnerability Scoring System (CVSS) metric. Name: Integrity (I). Group: Base. CVSS version: v3",
      "caption": "Integrity (I)",
      "enum": {
        "0": {
          "caption": "None (N)",
          "description": "The integrity level is unknown."
        },
        "1": {
          "caption": "Low (L)"
        },
        "2": {
          "caption": "High (H)"
        },
        "3": {
          "caption": "Medium"
        },
        "4": {
          "caption": "High"
        },
        "5": {
          "caption": "System"
        },
        "6": {
          "caption": "Protected"
        },
        "99": {
          "caption": "Other",
          "description": "The integrity level is not mapped. See the <code>integrity</code> attribute, which contains a data source specific value."
        }
      },
      "requirement": "optional",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      },
      "sibling": "integrity"
    },
    "integrity_impact_id": {
      "description": "Name: Integrity Impact (I). Group: Base. CVSS version: v1, v2",
      "enum": {
        "0": {
          "caption": "None (N)"
        },
        "1": {
          "caption": "Partial (P)"
        },
        "2": {
          "caption": "Complete (C)"
        }
      },
      "requirement": "optional",
      "caption": "Integrity Impact (I)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "target_distribution_id": {
      "description": "Name: Target Distribution (TD). Group: Environmental. CVSS version: v1, v2",
      "enum": {
        "0": {
          "caption": "None (N)"
        },
        "1": {
          "caption": "Low (L)"
        },
        "2": {
          "caption": "Medium (LM)"
        },
        "3": {
          "caption": "High (H)"
        },
        "4": {
          "caption": "Not Defined (ND)"
        }
      },
      "requirement": "optional",
      "caption": "Target Distribution (TD)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "modified_integrity_id": {
      "description": "Name: Modified Integrity (MI). Group: Environmental. Version: v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X)"
        },
        "1": {
          "caption": "None (N)"
        },
        "2": {
          "caption": "Low (L)"
        },
        "3": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "caption": "Modified Integrity (MI)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "exploitability_id": {
      "description": "Name: Exploitability (E). Group: Temporal. CVSS version: v1, v2",
      "enum": {
        "0": {
          "caption": "Not Defined (ND)"
        },
        "1": {
          "caption": "High (H)"
        },
        "2": {
          "caption": "Functional (F)"
        },
        "3": {
          "caption": "Proof-of-Concept (POC)"
        },
        "4": {
          "caption": "Unproven (U)"
        }
      },
      "requirement": "optional",
      "caption": "Exploitability (E)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "remediation_level_id": {
      "description": "Name: Remediation Level (RL). Group: Temporal. CVSS version: v1, v2, v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X, ND)"
        },
        "1": {
          "caption": "Unavailable (U)"
        },
        "2": {
          "caption": "Workaround (W)"
        },
        "3": {
          "caption": "Temporary Fix (T, TF)"
        },
        "4": {
          "caption": "Official Fix (O, OF)"
        }
      },
      "requirement": "optional",
      "caption": "Remediation Level (RL)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "modified_attack_vector_id": {
      "description": "Name: Modified Attack Vector (MAV). Group: Environmental. Version: v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X)"
        },
        "1": {
          "caption": "Network (N)"
        },
        "2": {
          "caption": "Adjacent (A)"
        },
        "3": {
          "caption": "Local (L)"
        },
        "4": {
          "caption": "Physical (P)"
        }
      },
      "requirement": "optional",
      "caption": "Modified Attack Vector (MAV)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "integrity_requirement_id": {
      "description": "Name: Integrity Requirement (IR). Group: Environmental. CVSS version: v2, v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X, ND)"
        },
        "1": {
          "caption": "Low (L)"
        },
        "2": {
          "caption": "Medium (LM)"
        },
        "3": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "caption": "Integrity Requirement (IR)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "collateral_damage_potential_id": {
      "description": "Name: Collateral Damage Potential (CDP). Group: Environmental. CVSS version: v1, v2",
      "enum": {
        "0": {
          "caption": "None (N)"
        },
        "1": {
          "caption": "Low (L)"
        },
        "2": {
          "caption": "Low-Medium (LM)"
        },
        "3": {
          "caption": "Medium-High (MH)"
        },
        "4": {
          "caption": "High (H)"
        },
        "5": {
          "caption": "Not Defined (ND)"
        }
      },
      "requirement": "optional",
      "caption": "Collateral Damage Potential (CDP)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "severity_id": {
      "caption": "Qualitative Severity Rating",
      "description": "The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score. None (0.0), Low (0.1 - 3.9), Medium (4.0 - 6.9), High (7.0 - 8.9), Critical (9.0 - 10.0)",
      "enum": {
        "0": {
          "caption": "None",
          "description": "The event severity is not known."
        },
        "1": {
          "caption": "Low",
          "description": "Informational message. No action required."
        },
        "2": {
          "caption": "Medium",
          "description": "The user decides if action is needed."
        },
        "3": {
          "caption": "High",
          "description": "Action is required but the situation is not serious at this time."
        },
        "4": {
          "caption": "Critical",
          "description": "Action is required immediately."
        },
        "-1": {
          "caption": "Other",
          "description": "The event severity is not mapped. See the <code>severity</code> attribute, which contains a data source specific value."
        },
        "5": {
          "caption": "Critical",
          "description": "Action is required immediately and the scope is broad."
        },
        "6": {
          "caption": "Fatal",
          "description": "An error occurred but it is too late to take remedial action."
        },
        "99": {
          "caption": "Other",
          "description": "The event/finding severity is not mapped. See the <code>severity</code> attribute, which contains a data source specific value."
        }
      },
      "requirement": "optional",
      "sibling": "severity",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "access_complexity_id": {
      "description": "Name: Access Complexity (AC). Group: Base. CVSS Version: v1, v2",
      "enum": {
        "0": {
          "caption": "Low (L)"
        },
        "1": {
          "caption": "Medium (M)"
        },
        "2": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "caption": "Access Complexity (AC)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "privileges_required_id": {
      "caption": "Privileges Required (PR)",
      "description": "The Privileges Required (PR) Common Vulnerability Scoring System (CVSS) metric. Name: Privileges Required (PR). Group: Base. CVSS version: v3",
      "enum": {
        "0": {
          "caption": "None (N)"
        },
        "1": {
          "caption": "Low (L)"
        },
        "2": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "availability_requirement_id": {
      "description": "Name: Availability Requirement (AR). Group: Environmental. CVSS version: v2, v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X, ND)"
        },
        "1": {
          "caption": "Low (L)"
        },
        "2": {
          "caption": "Medium (LM)"
        },
        "3": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "caption": "Availability Requirement (AR)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "modified_privileges_required_id": {
      "description": "Name: Modified Privileges Required (MPR). Group: Environmental. Version: v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X)"
        },
        "1": {
          "caption": "None (N)"
        },
        "2": {
          "caption": "Low (L)"
        },
        "3": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "caption": "Modified Privileges Required (MPR)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "report_confidence_id": {
      "description": "Name: Report Confidence (RC). Group: Temporal. CVSS version: v1, v2, v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X, ND)"
        },
        "1": {
          "caption": "Confirmed (C)"
        },
        "2": {
          "caption": "Reasonable (R)"
        },
        "3": {
          "caption": "Unconfirmed (UC)"
        },
        "4": {
          "caption": "Uncorroborated (UR)"
        },
        "5": {
          "caption": "Unknown (U)"
        }
      },
      "requirement": "optional",
      "caption": "Report Confidence (RC)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "confidentiality_id": {
      "caption": "Confidentiality (C)",
      "description": "The Confidentiality Common Vulnerability Scoring System (CVSS) metric. Name: Confidentiality (C). Group: Base. CVSS version: v3",
      "enum": {
        "0": {
          "caption": "None (N)",
          "description": "The confidentiality is unknown."
        },
        "1": {
          "caption": "Low (L)"
        },
        "2": {
          "caption": "High (H)"
        },
        "-1": {
          "caption": "Other"
        },
        "3": {
          "caption": "Secret"
        },
        "4": {
          "caption": "Top Secret"
        },
        "5": {
          "caption": "Private"
        },
        "6": {
          "caption": "Restricted"
        },
        "99": {
          "caption": "Other",
          "description": "The confidentiality is not mapped. See the <code>confidentiality</code> attribute, which contains a data source specific value."
        }
      },
      "requirement": "optional",
      "sibling": "confidentiality",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "confidentiality_requirement_id": {
      "description": "Name: Confidentiality Requirement (CR). Group: Environmental. CVSS version: v2, v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X, ND)"
        },
        "1": {
          "caption": "Low (L)"
        },
        "2": {
          "caption": "Medium (LM)"
        },
        "3": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "caption": "Confidentiality Requirement (CR)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "modified_confidentiality_id": {
      "description": "Name: Modified Confidentiality (MC). Group: Environmental. Version: v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X)"
        },
        "1": {
          "caption": "None (N)"
        },
        "2": {
          "caption": "Low (L)"
        },
        "3": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "caption": "Modified Confidentiality (MC)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "modified_user_interaction_id": {
      "description": "Name: Modified User Interaction (MUI). Group: Environmental. Version: v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X)"
        },
        "1": {
          "caption": "None (N)"
        },
        "2": {
          "caption": "Required (R)"
        }
      },
      "requirement": "optional",
      "caption": "Modified User Interaction (MUI)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "access_vector_id": {
      "description": "Name: Access Vector (AV). Group: Base. CVSS version: v1, v2",
      "enum": {
        "0": {
          "caption": "Local (L)"
        },
        "1": {
          "caption": "Adjacent Network (A)"
        },
        "2": {
          "caption": "Network (N)"
        }
      },
      "requirement": "optional",
      "caption": "Access Vector (AV)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "user_interaction_id": {
      "caption": "User Interaction (UI)",
      "description": "The User Interaction Common Vulnerability Scoring System (CVSS) metric. Name: User Interaction (UI). Group: Base. CVSS version: v3",
      "enum": {
        "0": {
          "caption": "None (N)"
        },
        "1": {
          "caption": "Required (R)"
        }
      },
      "requirement": "optional",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "confidentiality_impact_id": {
      "description": "Name: Confidentiality Impact (C). Group: Base CVSS version: v1, v2",
      "enum": {
        "0": {
          "caption": "None (N)"
        },
        "1": {
          "caption": "Partial (P)"
        },
        "2": {
          "caption": "Complete (C)"
        }
      },
      "requirement": "optional",
      "caption": "Confidentiality Impact (C)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "modified_attack_complexity_id": {
      "description": "Name: Modified Attack Complexity (MAC). Group: Environmental. Version: v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X)"
        },
        "1": {
          "caption": "Low (L)"
        },
        "2": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "caption": "Modified Attack Complexity (MAC)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "depth_id": {
      "description": "The CVSS depth. Representing a depth of the equation used to calculate CVSS score.",
      "enum": {
        "0": {
          "caption": "Base"
        },
        "1": {
          "caption": "Temporal"
        },
        "2": {
          "caption": "Environmental"
        }
      },
      "requirement": "recommended",
      "caption": "CVSS Depth",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "exploit_code_maturity_id": {
      "description": "Name: Exploit Code Maturity (E). Group: Temporal. CVSS version: v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X)"
        },
        "1": {
          "caption": "High (H)"
        },
        "2": {
          "caption": "Functional (F)"
        },
        "3": {
          "caption": "Proof-of-Concept (P)"
        },
        "4": {
          "caption": "Unproven (U)"
        }
      },
      "requirement": "optional",
      "caption": "Exploit Code Maturity (E)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "scope_id": {
      "description": "Name: Scope (S). Group: Base. CVSS version: v3",
      "enum": {
        "0": {
          "caption": "Unchanged (U)"
        },
        "1": {
          "caption": "Changed (C)"
        }
      },
      "requirement": "optional",
      "caption": "Scope (S)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "attack_complexity_id": {
      "caption": "Attack Complexity (AC)",
      "description": "The Attack Complexity Common Vulnerability Scoring System (CVSS) metric. Name: Attack Complexity (AC). Group: Base. CVSS version: v3",
      "enum": {
        "0": {
          "caption": "Low (L)"
        },
        "1": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "availability_impact_id": {
      "description": "Name: Availability Impact (A). Group: Base, CVSS version: v1, v2",
      "enum": {
        "0": {
          "caption": "None (N)"
        },
        "1": {
          "caption": "Partial (P)"
        },
        "2": {
          "caption": "Complete (C)"
        }
      },
      "requirement": "optional",
      "caption": "Availability Impact (A)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "modified_scope_id": {
      "description": "Name: Modified Scope (MS). Group: Environmental. Version: v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X)"
        },
        "1": {
          "caption": "Unchanged (U)"
        },
        "2": {
          "caption": "Changed (C)"
        }
      },
      "requirement": "optional",
      "caption": "Modified Scope (MS)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "raw_score": {
      "description": "CVSS Score in the range of 0.0 to 10.0.",
      "requirement": "recommended",
      "caption": "Reputation Score",
      "type": "float_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "attack_vector_id": {
      "description": "Name: Attack Vector (AV). Group: Base. CVSS version: v3",
      "enum": {
        "0": {
          "caption": "Network (N)"
        },
        "1": {
          "caption": "Adjacent (A)"
        },
        "2": {
          "caption": "Local (L)"
        },
        "3": {
          "caption": "Physical (P)"
        }
      },
      "requirement": "optional",
      "caption": "Attack Vector (AV)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "modified_availability_id": {
      "description": "Name: Modified Availability (MA). Group: Environmental. Version: v3",
      "enum": {
        "0": {
          "caption": "Not Defined (X)"
        },
        "1": {
          "caption": "None (N)"
        },
        "2": {
          "caption": "Low (L)"
        },
        "3": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "caption": "Modified Availability (MA)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "availability_id": {
      "description": "Name: Availability (A). Group: Base. CVSS version: v3",
      "enum": {
        "0": {
          "caption": "None (N)"
        },
        "1": {
          "caption": "Low (L)"
        },
        "2": {
          "caption": "High (H)"
        }
      },
      "requirement": "optional",
      "caption": "Availability (A)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "authentication_id": {
      "description": "Name: Authentication (Au). Group: Base. CVSS version: v1, v2",
      "enum": {
        "0": {
          "caption": "None"
        },
        "1": {
          "caption": "Single (S)"
        },
        "2": {
          "caption": "Multiple (M)"
        }
      },
      "requirement": "optional",
      "caption": "Authentication (Au)",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    }
  }
}