Skip to main content


A security finding, which may be a vulnerability or just an informative issue. A single finding may impact one or more resources. The IMPACTS relationship between the Vulnerability and the resource entity that was impacted serves as the record of the finding. The IMPACTS relationship carries properties such as 'identifiedOn', 'remediatedOn', 'remediationDueOn', 'issueLink', etc.

Finding properties
category *
string | arrayThe category of the finding.

Examples: data, application, host, network, endpoint, malware, event
numericSeverity *
numberSeverity rating based on impact and exploitability.

Examples: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10
open *
booleanIndicates if this is an open vulnerability.
severity *
stringSeverity rating based on impact and exploitability.

Examples: none, informational, low, medium, high, critical
assessmentstringThe name/id of the assessment that produced this finding.
blocksProductionbooleanIndicates whether this vulnerability finding is a blocking issue. If true, it should block a production deploy. Defaults to false.default: false
exploitabilitynumberThe exploitability score/rating.
impactstringThe impact description or rating.
prioritystringPriority level mapping to Severity rating. Can be a string such as 'critical', 'high', 'medium', 'low', 'info'. Or an integer usually between 0-5.
productionbooleanIndicates if this vulnerability is in production.
publicbooleanIndicates if this is a publicly disclosed vulnerability. If yes, this is usually a CVE and the 'webLink' should be set to '${CVE-Number}' or to a vendor URL. If not, it is most likely a custom application vulnerability.
recommendationstringRecommendation on how to remediate/fix this finding.
referencesarray of stringsThe array of links to references.
remediationSLAintegerThe number of days that the Vulnerability must be remediated within, based on SLA set by the organization's internal vulnerability management program policy. The actually due date is set by 'remediationDueOn' property on the IMPACTS relationship between the Vulnerability and its impacted resource entity.
scorenumberThe overall vulnerability score, e.g. CVSSv3.
statusstringStatus of the vulnerability
stepsToReproducearray of stringsSteps to reproduce this finding.
targetDetailsarray of stringsAdditional details about the targets. Can be a string or an array.
targetsarray of stringsThe target listing of projects, applications, repos or systems this vulnerability impacts. Specifying either the project/repo name or the application URL here will auto-map this Vulnerability to the corresponding Project/CodeRepo/Application entity if a match is found.
validatedbooleanIndicates if this Vulnerability finding has been validated by the security team.
vectorstringThe vulnerability attack vector. (e.g. a CVSSv3 vector looks like this - 'AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N')
Inherited properties
_class *
string |
array of strings
One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '_class':'Host'.
_key *
stringAn identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role.minLength: 10
_type *
stringThe type of object, typically reflecting the vendor and resource type. For example, 'aws_iam_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user_endpoint' or 'cve'.minLength: 3
displayName *
stringDisplay name, e.g. a person's preferred name or an AWS account alias
name *
stringName of this entity
approvedbooleanIf this is record has been reviewed and approved.
approvedOnnumberThe timestamp (in milliseconds since epoch) when this record was approved.
Format: date-time

approversarray of stringsThe list of approvers on the record.
classificationstringThe sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public.

Examples: critical, confidential, internal, public
contentstringText content of the record/documentation
createdOnnumberThe timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than _createdOn which is the timestamp the entity was first ingested into JupiterOne.
Format: date-time

descriptionstringAn extended description of this entity.
exceptionbooleanIndicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved.
exceptionReasonstringReason / description of the exception.
reportedOnnumberThe timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as createdOn but occasionally a record can be created at a different time than when it was first reported.
Format: date-time

reporterstringThe person or system that reported or created this record.
summarystringA summary / short description of this entity.
updatedOnnumberThe timestamp (in milliseconds since epoch) when the entity was last updated at the source.
Format: date-time

webLinkstringHyperlink to the location of this record, e.g. URL to a Jira issue
Format: uri

Required properties
  • _key
  • _class
  • _type
  • name
  • displayName
  • category
  • severity
  • numericSeverity
  • open