Vulnerability Export Schema

Reference the vulnerability object schema and properties used in Mondoo JSONL exports.

This is the schema Mondoo uses when exporting vulnerability data to JSONL.

Vulnerability properties

Property	Type	Required?	Nullable?
space_mrn	`string`	Yes	No
space_id	`string`	Yes	No
space_name	`string`	Yes	No
asset_id	`string`	Yes	No
asset_mrn	`string`	Yes	No
asset_name	`string`	Yes	No
vuln_mrn	`string`	Yes	No
vuln_id	`string`	Yes	No
type	`string`	Yes	No
summary	`string`	Yes	No
first_detected_on	`string`	Yes	No
resolved_on	`string`	Yes	Yes
published_date	`string`	No	Yes
exported_at	`string`	Yes	No
time_travel_id	`string`	Yes	No
url	`string`	Yes	No
cvss_score	`integer`	No	No
cvss_severity	`string`	No	No
cvss_vector	`string`	No	No
risk_factors	`JSON`	No	Yes
risk_score	`integer`	Yes	No
risk_value	`integer`	Yes	No
preview_risk_score	`integer`	Yes	Yes
preview_risk_value	`integer`	Yes	Yes
risk_severity	`string`	Yes	No
base_score	`integer`	Yes	No
references	`JSON`	No	Yes
cve_refs	`JSON`	No	Yes
remediation	`JSON`	No	Yes
evidence	`JSON`	No	Yes
epss_score	`number`	No	Yes
epss_percentile	`number`	No	Yes
sources	`JSON`	No	Yes
sla_state	`string`	Yes	No
sla_rating	`string`	Yes	No
sla_started_at	`string`	Yes	Yes
sla_warn_at	`string`	Yes	Yes
sla_deadline	`string`	Yes	Yes
sla_days_to_resolve	`integer`	Yes	Yes
sla_resolved_within	`boolean`	Yes	Yes

space_mrn property

Mondoo identifier for the space containing the asset

space_mrn

Type	Required?	Nullable?
String	Yes	No

space_id property

Unique identifier for the space containing the asset

space_id

Type	Required?	Nullable?
String	Yes	No

space_name property

Name of the space containing the asset

space_name

Type	Required?	Nullable?
String	Yes	No

asset_id property

Space-unique asset identifier

asset_id

Type	Required?	Nullable?
String	Yes	No

asset_mrn property

Globally unique asset MRN

asset_mrn

Type	Required?	Nullable?
String	Yes	No

asset_name property

Asset display name

asset_name

Type	Required?	Nullable?
String	Yes	No

vuln_mrn property

Mondoo identifier for the vulnerability

vuln_mrn

Type	Required?	Nullable?
String	Yes	No

vuln_id property

CVE ID or equivalent advisory number

vuln_id

Type	Required?	Nullable?
String	Yes	No

type property

The type of the vulnerability (CVE, Package, etc.)

type

Type	Required?	Nullable?
String	Yes	No

summary property

Brief description of the vulnerability

summary

Type	Required?	Nullable?
String	Yes	No

first_detected_on property

Timestamp from when the vulnerability was first detected. This is a date-time string matching RFC 3339, section 5.6.

first_detected_on

Type	Required?	Nullable?
String	Yes	No

resolved_on property

Timestamp from when the vulnerability was resolved. This is a date-time string matching RFC 3339, section 5.6. Null if the vulnerability is not yet resolved.

resolved_on

Type	Required?	Nullable?
String	Yes	Yes

published_date property

Public disclosure date. This is a date-time string matching RFC 3339, section 5.6. Null if the date is not available.

published_date

Type	Required?	Nullable?
String	No	Yes

exported_at property

Timestamp from when this vulnerability data was exported. This is a date-time string matching RFC 3339, section 5.6.

exported_at

Type	Required?	Nullable?
String	Yes	No

time_travel_id property

Point-in-time query ID

time_travel_id

Type	Required?	Nullable?
String	Yes	No

url property

Console URL for the vulnerability

url

Type	Required?	Nullable?
String	Yes	No

cvss_score property

CVSS score in integer format (for example, 9.8 is represented as 98)

cvss_score

Type	Required?	Nullable?
Integer	No	No

cvss_severity property

CVSS severity (Critical, High, Medium, Low, None)

cvss_severity

Type	Required?	Nullable?
String	No	No

cvss_vector property

CVSS vector string

cvss_vector

Type	Required?	Nullable?
String	No	No

risk_score property

Risk score (0-100)

risk_score

Type	Required?	Nullable?
Integer	Yes	No

risk_value property

Derived value: 100 - risk_score

risk_value

Type	Required?	Nullable?
Integer	Yes	No

preview_risk_score property

Risk score from a preview version of the Mondoo risk scoring model (0-100). Null when no preview score is available.

preview_risk_score

Type	Required?	Nullable?
Integer	Yes	Yes

preview_risk_value property

Derived value: 100 - preview_risk_score. Null when preview_risk_score is null.

preview_risk_value

Type	Required?	Nullable?
Integer	Yes	Yes

risk_severity property

Severity rating derived from the risk score (Critical, High, Medium, Low, None)

risk_severity

Type	Required?	Nullable?
String	Yes	No

base_score property

Base score (0-100)

base_score

Type	Required?	Nullable?
Integer	Yes	No

references property

Reference URLs for CVEs and advisories

references

Type	Required?	Nullable?
JSON	No	Yes

cve_refs property

Cross-referenced CVE IDs

cve_refs

Type	Required?	Nullable?
JSON	No	Yes

remediation property

JSON remediation data

remediation

Type	Required?	Nullable?
JSON	No	Yes

evidence property

Evidence objects

evidence

Type	Required?	Nullable?
JSON	No	Yes

epss_score property

Exploit Prediction Scoring System score (0.0-1.0)

epss_score

Type	Required?	Nullable?
Number	No	Yes

epss_percentile property

EPSS percentile (0.0-100.0)

epss_percentile

Type	Required?	Nullable?
Number	No	Yes

Detection sources that reported the vulnerability (for example, cnspec, SentinelOne, or CrowdStrike). Each entry has a name and, optionally, a url, first_detected_at, last_updated_at, and fixed_at.

sources

Type	Required?	Nullable?
JSON	No	Yes

sla_state property

SLA position as of the export run: over, nearing, within, or none

sla_state

Type	Required?	Nullable?
String	Yes	No

sla_rating property

Rating whose SLA applies to the finding. Empty when the finding has no SLA window.

sla_rating

Type	Required?	Nullable?
String	Yes	No

sla_started_at property

Time the SLA clock started. Null when the finding has no SLA window. This is a date-time string matching RFC 3339, section 5.6.

sla_started_at

Type	Required?	Nullable?
String	Yes	Yes

sla_warn_at property

Time from which an open finding is nearing its SLA deadline. Null when the finding has no SLA window. This is a date-time string matching RFC 3339, section 5.6.

sla_warn_at

Type	Required?	Nullable?
String	Yes	Yes

sla_deadline property

Time after which an open finding is over its SLA. Null when the finding has no SLA window. This is a date-time string matching RFC 3339, section 5.6.

sla_deadline

Type	Required?	Nullable?
String	Yes	Yes

sla_days_to_resolve property

Number of days the SLA allows for the finding's rating. Null when the finding has no SLA window.

sla_days_to_resolve

Type	Required?	Nullable?
Integer	Yes	Yes

sla_resolved_within property

For a resolved finding with an SLA window, whether it was resolved on or before sla_deadline. Null otherwise.

sla_resolved_within

Type	Required?	Nullable?
Boolean	Yes	Yes

Vulnerability Export Schema

On this page