Reference — Universal Schema

Finding Schema v1.1

All findings across the toolkit conform to the universal schema v1.1.

Required

Field	Type	Description
`id`	str (UUID4)	Unique finding identifier
`tool`	str	Canonical lowercase tool name
`title`	str	Finding title
`datetime`	str (ISO 8601)	When the finding was produced
`ip`	str	Target IP address
`port`	int	Target port (0 if N/A)
`risk`	str	CRITICAL \| HIGH \| MEDIUM \| LOW \| INFO (UPPERCASE)
`command`	str	Command that produced the finding
`description`	str	What the finding is (non-empty)
`sources`	str	Data sources (newline-separated when merged)
`affected`	str	Affected component or asset
`remediation`	str	How to fix it (non-empty)
`exploitdb`	bool	ExploitDB entry exists
`metasploit`	bool	Metasploit module exists
`exploit_details`	list[dict]	Exploit detail objects

Optional V1 0

Field	Type	Description
`hostname`	str\|null	Target hostname
`scope`	str\|null	int or ext
`phase`	str	Scan phase that produced the finding
`catalogue_id`	str	Findings catalogue entry ID (SS-001, FR-001, etc.)
`output`	str	Raw output excerpt (max 4096 chars)
`output_file`	str	Run-dir-relative path to evidence file
`cves`	str	Comma-separated CVE IDs
`service`	str	Service name (http, ssh, smb, etc.)
`owasp`	str	OWASP Web Top 10 category
`owasp_url`	str	OWASP reference URL
`nist`	str	NIST reference

Enrichment V1 1

Field	Type	Description
`cvss_score`	float\|null	CVSS v3 base score
`cvss_vector`	str	Full CVSS:3.1 vector string
`cwe`	list[str]	CWE identifiers (e.g. CWE-79)
`nessus_plugin_id`	int\|null	Equivalent Nessus plugin ID
`nessus_plugin_name`	str	Nessus plugin name
`qualys_qid`	int\|null	Equivalent Qualys QID
`plugin_output`	str	External scanner plugin output
`nist_800_53`	list[str]	NIST SP 800-53 controls
`nist_800_171`	list[str]	NIST SP 800-171 controls
`nist_csf2`	list[str]	NIST CSF 2.0 subcategories
`pci_dss_4`	list[str]	PCI DSS v4.0 requirements
`iso_27001`	list[str]	ISO 27001 controls
`iso_27002`	list[str]	ISO 27002 controls
`soc2`	list[str]	SOC 2 criteria
`hitrust`	list[str]	HITRUST CSF controls
`gdpr`	list[str]	GDPR articles
`mitre_attack`	list[dict]	MITRE ATT&CK techniques [{technique, tactic, name}]
`kev`	bool	CISA Known Exploited Vulnerabilities catalog hit
`searchsploit_terms`	list[str]	ExploitDB search terms
`metasploit_modules`	list[str]	Metasploit module paths
`remediation_effort`	str	Easy \| Moderate \| Significant \| Major
`remediation_component`	str	Application \| Network \| Auth \| Config
`remediation_category`	str	Input Validation \| Access Control \| Cryptography \| etc.
`owasp_api`	str	OWASP API Top 10 category
`ssid`	str	Wireless SSID (Aether)
`bssid`	str	Wireless BSSID (Aether)
`wireless_data`	dict	Wireless-specific data (Aether)
`subdevice`	str	Device sub-component (Gearbox)
`interface`	str	Network interface (Gearbox)
`instance`	str	Service instance (Gearbox)
`classification`	str	Device classification (Gearbox)
`api_endpoint_path`	str	API endpoint path (Siphon)
`api_method`	str	HTTP method (Siphon)
`api_from_spec`	bool	Endpoint from spec (Siphon)
`is_rogue_endpoint`	bool	Undocumented endpoint (Siphon)
`accepted`	bool	Finding accepted by reviewer
`confidence`	str	Certain \| Firm \| Tentative
`aliases`	list[str]	Alternative finding titles
`source_tools`	list[str]	Tools that produced this finding
`cve_examples`	list[str]	Example CVEs
`impact`	str	What an attacker can achieve and business consequence

meta.json Format

Every run directory must contain a meta.json identifying the tool, client, and engagement. Built via pr0t31n_schema.make_meta().

Required

Field	Type	Description
`schema_version`	str	Always '1.1'
`tool`	str	Canonical tool name
`version`	str	Tool version from VERSION file
`client`	str	Client short name
`started`	str (ISO 8601)	Scan start timestamp
`hostname`	str	Scanner hostname
`platform`	str	OS platform string

Run Directory Structure

Canonical path: <clients_base>/<client_short>/<year>/<tool_name>/<client_short>_<YYYYMMDD_HHMMSS>/

Required Files

meta.json
findings.json
findings.csv
summary.json
scan.log
scan.log.json
errors.log

Optional Files

checkpoint.json
correlated.json
falsePositives.json
falsePositives.csv
evidence/
inventory/

.log Sibling Format (Section 14)

Every third-party tool invocation produces a .log sibling file next to its primary output.

Reference Documentation

Topics

Universal Schema

Finding Schema v1.1

Required

Optional V1 0

Enrichment V1 1

meta.json Format

Required

Run Directory Structure

Required Files

Optional Files

.log Sibling Format (Section 14)