CveList

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/honeylabs-net/json-schema/honeylabs-net-cve-list-schema.json",
  "title": "CveList",
  "description": "Counts cover both sensor types: first contact (requests matching the CVE's detection signatures) and the requests the interactive sensors answered that count as a probe for the CVE (the sensor's rule for that CVE was the only one the request matched, on a path first contact's exclusions accept, or the request or its session carried the exploit). A request that matched several CVE rules counts for none. UDP is left out on both sides. A CVE only the interactive sensors saw is a row like any other; its title, severity and KEV flag come from probe_tags or NVD when either has them, and are empty otherwise.",
  "x-generated": "2026-11-11",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/honeylabs-net-openapi.json#/components/schemas/CveList",
  "type": "object",
  "properties": {
    "window": {
      "type": "string"
    },
    "pro": {
      "type": "boolean"
    },
    "window_notice": {
      "$ref": "#/$defs/WindowNotice"
    },
    "cves": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "tag_id": {
            "type": "string"
          },
          "title": {
            "type": "string",
            "description": "The detection signature's title, else the KEV catalogue's vulnerabilityName, else a title HoneyLabs writes for an id the interactive sensors record that neither names. Empty when none applies."
          },
          "severity": {
            "type": "string"
          },
          "actively_exploited": {
            "type": "boolean",
            "description": "On the CISA Known Exploited Vulnerabilities catalogue, or flagged as listed by the CVE's detection signatures. The catalogue is the first source and covers CVEs without a signature."
          },
          "events": {
            "type": "integer",
            "description": "Probes in the window on both sensor types: first_contact_events plus interactive_requests."
          },
          "unique_ips": {
            "type": "integer",
            "description": "Distinct source addresses over both sensor types. An address both saw counts once, so this is not a sum."
          },
          "interaction_sessions": {
            "type": "integer",
            "description": "Sessions on interactive sensors that sent the exploit in the window, on any transport. 0 when none."
          },
          "first_contact_events": {
            "type": "integer",
            "description": "Requests matching the CVE's detection signatures."
          },
          "first_contact_ips": {
            "type": "integer",
            "description": "Distinct addresses behind first_contact_events."
          },
          "interactive_requests": {
            "type": "integer",
            "description": "Requests to the interactive sensors that count as a probe for the CVE, plus one per session whose payload proved it without a counted request. 0 when none."
          },
          "interactive_sources": {
            "type": "integer",
            "description": "Distinct addresses behind interactive_requests."
          },
          "last_seen": {
            "type": [
              "string",
              "null"
            ],
            "description": "Date (YYYY-MM-DD, UTC) of the latest probe on either sensor type."
          },
          "published": {
            "type": [
              "string",
              "null"
            ],
            "description": "NVD publication date when cached."
          },
          "kev_date_added": {
            "type": [
              "string",
              "null"
            ],
            "description": "The date CISA added the CVE to the KEV catalogue (YYYY-MM-DD, its dateAdded). null when the catalogue does not list it."
          }
        }
      }
    }
  },
  "$defs": {
    "WindowNotice": {
      "type": "object",
      "description": "Present when the requested window exceeded the plan and the response was shortened.",
      "properties": {
        "requested_days": {
          "type": "integer"
        },
        "returned_days": {
          "type": "integer"
        },
        "reason": {
          "type": "string"
        },
        "upgrade": {
          "type": "string",
          "format": "uri"
        }
      }
    }
  }
}