Problem

A problem identified from the analysis and correlation of assets and findings that is a notable issue worthy of action. It could be (or become) the cause, or potential cause, of one or more incidents or findings.

Inherited properties

Property	Type	Description	Specifications
_class *	string | array of strings	One or more classes conforming to a standard, abstract security data model. For example, an EC2 instance will have '_class':'Host'.
_key *	string	An identifier unique within the scope containing the object. For example, for a Bitbucket repo, this will be the GUID of the repo as assigned by Bitbucket. For an IAM Role, this will be the ARN of the role.	minLength: 10
_type *	string	The type of object, typically reflecting the vendor and resource type. For example, 'aws_iam_user'. In some cases, a system knows about a type of entity that other systems know about, such as 'user_endpoint' or 'cve'.	minLength: 3
category *	string | array **	** null	The category of the finding. Examples: data, application, host, network, endpoint, malware, event
displayName *	string	Display name, e.g. a person's preferred name or an AWS account alias
name *	string	Name of this entity
numericSeverity *	number | null	Severity rating based on impact and exploitability. Examples: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10
open *	boolean | null	Indicates if this is an open vulnerability.
severity *	string | null	Severity rating based on impact and exploitability. Examples: none, informational, low, medium, high, critical
approved	boolean	If this is record has been reviewed and approved.
approvedOn	number	The timestamp (in milliseconds since epoch) when this record was approved.	Format: date-time
approvers	array of strings	The list of approvers on the record.
assessment	string | null	The name/id of the assessment that produced this finding.
blocksProduction	boolean | null	Indicates whether this vulnerability finding is a blocking issue. If true, it should block a production deploy. Defaults to false.
classification	string	The sensitivity of the data; should match company data classification scheme. For example: critical - confidential - internal - public. Examples: critical, confidential, internal, public
content	string	Text content of the record/documentation
createdOn	number	The timestamp (in milliseconds since epoch) when the entity was created at the source. This is different than _createdOn which is the timestamp the entity was first ingested into JupiterOne.	Format: date-time
description	string	An extended description of this entity.
exception	boolean	Indicates if this record has an applied exception. For example, exception for a known finding or a PR that is not fully approved.
exceptionReason	string	Reason / description of the exception.
exploitability	number | null	The exploitability score/rating.
impact	number | null	The impact description or rating.
priority	string | null	Priority level mapping to Severity rating. Can be a string such as 'critical', 'high', 'medium', 'low', 'info'. Or an integer usually between 0-5.
production	boolean | null	Indicates if this vulnerability is in production.
public	boolean | null	Indicates if this is a publicly disclosed vulnerability. If yes, this is usually a CVE and the 'webLink' should be set to 'https://nvd.nist.gov/vuln/detail/${CVE-Number}' or to a vendor URL. If not, it is most likely a custom application vulnerability.
recommendation	string | null	Recommendation on how to remediate/fix this finding.	deprecated: true
recommendedActions	string | null	Recommended remediation actions or steps to address a finding, vulnerability or weakness. This field supports markdown formatting for rich text content including links, code blocks, and structured lists. Markdown-formatted text describing remediation steps is preferred.
references	array | null	The array of links to references.
remediationSLA	integer | null	The number of days that the Vulnerability must be remediated within, based on SLA set by the organization's internal vulnerability management program policy. The actually due date is set by 'remediationDueOn' property on the IMPACTS relationship between the Vulnerability and its impacted resource entity.
reportedOn	number	The timestamp (in milliseconds since epoch) when this record was reported/opened. In most cases, this would be the same as createdOn but occasionally a record can be created at a different time than when it was first reported.	Format: date-time
reporter	string	The person or system that reported or created this record.
score	number | null	The overall vulnerability score, e.g. CVSSv3.
status	string | null	Status of the vulnerability
stepsToReproduce	array | null	Steps to reproduce this finding.
summary	string	A summary / short description of this entity.
targetDetails	array | null	Additional details about the targets. Can be a string or an array.
targets	array | null	The target listing of projects, applications, repos or systems this vulnerability impacts. Specifying either the project/repo name or the application URL here will auto-map this Vulnerability to the corresponding Project/CodeRepo/Application entity if a match is found.
updatedOn	number	The timestamp (in milliseconds since epoch) when the entity was last updated at the source.	Format: date-time
validated	boolean | null	Indicates if this Vulnerability finding has been validated by the security team.
vector	string | null	The vulnerability attack vector. (e.g. a CVSSv3 vector looks like this - 'AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N')
webLink	string	Hyperlink to the location of this record, e.g. URL to a Jira issue	Format: uri

Required properties

• _key
• _class
• _type
• name
• displayName
• category
• severity
• numericSeverity
• open