Package Export Schema
Reference the package object schema and properties used in Mondoo JSONL exports.
This is the schema Mondoo uses when exporting package data to JSONL.
CSV exports name the name and version columns package_name and package_version.
Package type
object
Package properties
| Property | Type | Required? | Nullable? |
|---|---|---|---|
| space_mrn | string | Yes | No |
| space_id | string | Yes | No |
| space_name | string | Yes | No |
| asset_id | string | Yes | No |
| asset_mrn | string | Yes | No |
| asset_name | string | Yes | No |
| name | string | Yes | No |
| version | string | Yes | No |
| fixed_version | string | Yes | No |
| vuln_mrns | JSON | No | Yes |
| vuln_ids | JSON | No | Yes |
| first_detected_on | string | Yes | No |
| resolved_on | string | Yes | Yes |
| exported_at | string | Yes | No |
| cvss_score | integer | No | No |
| cvss_severity | string | No | No |
| risk_factors | JSON | No | Yes |
| base_score | integer | Yes | No |
| risk_score | integer | Yes | No |
| risk_value | integer | Yes | No |
| time_travel_id | string | Yes | No |
| remediation | JSON | No | Yes |
| evidence | JSON | No | Yes |
| evidence_total_count | integer | Yes | No |
space_mrn property
Mondoo identifier for the space containing the asset
space_mrn
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
space_id property
Unique identifier for the space containing the asset
space_id
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
space_name property
Name of the space containing the asset
space_name
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
asset_id property
Space-unique asset identifier
asset_id
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
asset_mrn property
Globally unique asset MRN
asset_mrn
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
asset_name property
Asset display name
asset_name
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
name property
Package name
name
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
version property
Installed package version
version
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
fixed_version property
Version with a fix available. Empty string if no fix is available.
fixed_version
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
vuln_mrns property
Associated vulnerability MRNs
vuln_mrns
| Type | Required? | Nullable? |
|---|---|---|
| JSON | No | Yes |
vuln_ids property
Associated vulnerability IDs (CVE IDs or equivalent)
vuln_ids
| Type | Required? | Nullable? |
|---|---|---|
| JSON | No | Yes |
first_detected_on property
Timestamp from when the vulnerable package was first detected. This is a date-time string matching RFC 3339, section 5.6.
first_detected_on
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
resolved_on property
Timestamp from when the vulnerability was resolved. This is a date-time string matching RFC 3339, section 5.6. Null if not yet resolved.
resolved_on
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | Yes |
exported_at property
Timestamp when this data was exported. This is a date-time string matching RFC 3339, section 5.6.
exported_at
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
cvss_score property
Maximum CVSS score of associated vulnerabilities, in integer format (for example, 9.8 is represented as 98)
cvss_score
| Type | Required? | Nullable? |
|---|---|---|
| Integer | No | No |
cvss_severity property
CVSS severity (Critical, High, Medium, Low, None)
cvss_severity
| Type | Required? | Nullable? |
|---|---|---|
| String | No | No |
risk_factors property
Read Risk Factor Export Schema.
base_score property
Base score (0-100)
base_score
| Type | Required? | Nullable? |
|---|---|---|
| Integer | Yes | No |
risk_score property
Risk score (0-100)
risk_score
| Type | Required? | Nullable? |
|---|---|---|
| Integer | Yes | No |
risk_value property
Derived value: 100 - risk_score
risk_value
| Type | Required? | Nullable? |
|---|---|---|
| Integer | Yes | No |
time_travel_id property
Point-in-time query ID
time_travel_id
| Type | Required? | Nullable? |
|---|---|---|
| String | Yes | No |
remediation property
JSON remediation data
remediation
| Type | Required? | Nullable? |
|---|---|---|
| JSON | No | Yes |
evidence property
Evidence objects
evidence
| Type | Required? | Nullable? |
|---|---|---|
| JSON | No | Yes |
evidence_total_count property
Total number of evidence records for this package. A value greater than the number of entries in evidence means the list was truncated.
evidence_total_count
| Type | Required? | Nullable? |
|---|---|---|
| Integer | Yes | No |