|
40 | 40 | description="The publish outcome group.", |
41 | 41 | version="1.0.0", |
42 | 42 | outcomes=( |
43 | | - OutcomeValue( |
44 | | - name="Do Not Publish", key="N", description="Do Not Publish" |
45 | | - ), |
| 43 | + OutcomeValue(name="Do Not Publish", key="N", description="Do Not Publish"), |
46 | 44 | OutcomeValue(name="Publish", key="P", description="Publish"), |
47 | 45 | ), |
48 | 46 | ) |
|
109 | 107 | The CVSS outcome group. |
110 | 108 | """ |
111 | 109 |
|
112 | | -CISA = OutcomeGroup( |
| 110 | +CISA_1 = OutcomeGroup( |
113 | 111 | name="CISA Levels", |
114 | 112 | description="The CISA outcome group. " |
115 | 113 | "CISA uses its own SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: Track, Track*, Attend, and Act.", |
|
124 | 122 | ), |
125 | 123 | OutcomeValue( |
126 | 124 | name="Track*", |
127 | | - key="T*", |
| 125 | + key="R", |
128 | 126 | description="The vulnerability contains specific characteristics that may require closer monitoring for changes. " |
129 | 127 | "CISA recommends remediating Track* vulnerabilities within standard update timelines.", |
130 | 128 | ), |
|
137 | 135 | ), |
138 | 136 | OutcomeValue( |
139 | 137 | name="Act", |
| 138 | + key="C", |
| 139 | + description="The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. " |
| 140 | + "Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. " |
| 141 | + "Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. " |
| 142 | + "CISA recommends remediating Act vulnerabilities as soon as possible.", |
| 143 | + ), |
| 144 | + ), |
| 145 | +) |
| 146 | +""" |
| 147 | +The CISA outcome group. Based on CISA's customizations of the SSVC model. |
| 148 | +See https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc |
| 149 | +""" |
| 150 | + |
| 151 | +CISA = OutcomeGroup( |
| 152 | + name="CISA Levels", |
| 153 | + description="The CISA outcome group. " |
| 154 | + "CISA uses its own SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: Track, Monitor, Attend, and Act.", |
| 155 | + version="1.1.0", |
| 156 | + outcomes=( |
| 157 | + OutcomeValue( |
| 158 | + name="Track", |
| 159 | + key="T", |
| 160 | + description="The vulnerability does not require action at this time. " |
| 161 | + "The organization would continue to track the vulnerability and reassess it if new information becomes available. " |
| 162 | + "CISA recommends remediating Track vulnerabilities within standard update timelines.", |
| 163 | + ), |
| 164 | + OutcomeValue( |
| 165 | + name="Monitor", |
| 166 | + key="M", |
| 167 | + description="The vulnerability contains specific characteristics that may require closer monitoring for changes. " |
| 168 | + "CISA recommends remediating Monitor vulnerabilities within standard update timelines.", |
| 169 | + ), |
| 170 | + OutcomeValue( |
| 171 | + name="Attend", |
140 | 172 | key="A", |
| 173 | + description="The vulnerability requires attention from the organization's internal, supervisory-level individuals. " |
| 174 | + "Necessary actions may include requesting assistance or information about the vulnerability and may involve publishing a notification, either internally and/or externally, about the vulnerability. " |
| 175 | + "CISA recommends remediating Attend vulnerabilities sooner than standard update timelines.", |
| 176 | + ), |
| 177 | + OutcomeValue( |
| 178 | + name="Act", |
| 179 | + key="C", |
141 | 180 | description="The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. " |
142 | 181 | "Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. " |
143 | 182 | "Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. " |
|
150 | 189 | See https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc |
151 | 190 | """ |
152 | 191 |
|
| 192 | + |
153 | 193 | YES_NO = OutcomeGroup( |
154 | 194 | name="Yes, No", |
155 | 195 | description="The Yes/No outcome group.", |
|
170 | 210 | outcomes=( |
171 | 211 | # drop, reconsider later, easy win, do first |
172 | 212 | OutcomeValue(name="Drop", key="D", description="Drop"), |
173 | | - OutcomeValue( |
174 | | - name="Reconsider Later", key="R", description="Reconsider Later" |
175 | | - ), |
| 213 | + OutcomeValue(name="Reconsider Later", key="R", description="Reconsider Later"), |
176 | 214 | OutcomeValue(name="Easy Win", key="E", description="Easy Win"), |
177 | 215 | OutcomeValue(name="Do First", key="F", description="Do First"), |
178 | 216 | ), |
|
187 | 225 | version="1.0.0", |
188 | 226 | outcomes=( |
189 | 227 | OutcomeValue(name="Track 5", key="5", description="Track"), |
190 | | - OutcomeValue( |
191 | | - name="Track Closely 4", key="4", description="Track Closely" |
192 | | - ), |
| 228 | + OutcomeValue(name="Track Closely 4", key="4", description="Track Closely"), |
193 | 229 | OutcomeValue(name="Attend 3", key="3", description="Attend"), |
194 | 230 | OutcomeValue(name="Attend 2", key="2", description="Attend"), |
195 | 231 | OutcomeValue(name="Act 1", key="1", description="Act"), |
|
0 commit comments