69 lines
4.0 KiB
TypeScript
69 lines
4.0 KiB
TypeScript
import type { ToolProfileDefinition } from '../../domain/tool-profile-definition';
|
|
import { commonSeverityMappings, commonStatusMappings } from '../common-normalization';
|
|
|
|
export const defenderForIotDefinition: ToolProfileDefinition = {
|
|
schemaVersion: 1,
|
|
id: 'defender-for-iot-vulnerabilities',
|
|
securityScoring: {
|
|
version: '1.0.0',
|
|
native: { kind: 'unavailable', reason: 'Affected-device counts describe vulnerability reach, not a native security score.' },
|
|
targets: [], resultPopulation: 'findings-only'
|
|
},
|
|
priorityBasis: {
|
|
version: '1.0.0',
|
|
basis: { kind: 'severity', properties: ['vulnerability.severity'] },
|
|
excludedProperties: [
|
|
{ property: 'affected-device-count', reason: 'Vulnerability reach is not a criticality.' }
|
|
]
|
|
},
|
|
timeslotComparison: {
|
|
version: '1.0.0', kind: 'unavailable',
|
|
reason: 'The aggregated CVE export does not establish complete negative evidence for vulnerability remediation.'
|
|
},
|
|
name: 'Microsoft Defender for IoT',
|
|
version: '1.2.0',
|
|
processing: {
|
|
mappingVersion: '1.0.0', normalizationVersion: '1.1.0', presentationVersion: '1.0.0',
|
|
compatibilityKey: 'defender-for-iot-vulnerabilities-v2', changeClass: 'semantic-breaking',
|
|
reimportRequired: true, affectedDimensions: ['recognition', 'extraction', 'finding-identity', 'evidence']
|
|
},
|
|
sourceSignals: [
|
|
{ scope: 'header', pattern: /^TotalCVEs$/i, contribution: 0.45, message: 'The asset summary exposes TotalCVEs.' },
|
|
{ scope: 'header', pattern: /^CVE$/i, contribution: 0.38, message: 'The detail table exposes CVE identifiers.' },
|
|
{ scope: 'header', pattern: /^Sensor$/i, contribution: 0.14, message: 'The source records a reporting sensor.' },
|
|
{ scope: 'header', pattern: /^Beschreibung$/i, contribution: 0.18, message: 'The detail table exposes the Defender CVE description field.' },
|
|
{ scope: 'header', pattern: /^Critical$/i, contribution: 0.1, message: 'The asset summary exposes Critical counts.' },
|
|
{ scope: 'header', pattern: /^Device ID$/i, contribution: 0.24, message: 'The source exposes the Defender device identifier.' },
|
|
{ scope: 'header', pattern: /^CVSS Score$/i, contribution: 0.2, message: 'The CVE export exposes a CVSS score.' },
|
|
{ scope: 'header', pattern: /^Component$/i, contribution: 0.1, message: 'The CVE export identifies the affected component.' }
|
|
],
|
|
tableRules: {
|
|
preferredNames: [
|
|
{ pattern: /asset|device|summary/i, contribution: 0.45, message: 'Likely asset summary table.' },
|
|
{ pattern: /vulnerab|cve|detail/i, contribution: 0.55, message: 'Likely vulnerability detail table.' }
|
|
],
|
|
discouragedNames: []
|
|
},
|
|
fieldRules: [
|
|
{ role: 'rule-id', headers: [{ pattern: /^CVE$/i, contribution: 1, message: 'CVE is the source-native finding identifier.' }] },
|
|
{ role: 'description', headers: [{ pattern: /^(?:Beschreibung|Description)$/i, contribution: 1, message: 'The field contains the CVE description.' }] },
|
|
{ role: 'severity', headers: [{ pattern: /^Severity$/i, contribution: 1, message: 'The field contains the vulnerability severity.' }] },
|
|
{ role: 'asset', headers: [{ pattern: /^Affected Device Count$/i, contribution: 0.92, message: 'The aggregated affected-device count stands in for the affected object of this CVE.' }] },
|
|
{ role: 'evidence', headers: [{ pattern: /^Source Observations$/i, contribution: 1, message: 'The field preserves every sensor observation and row locator.' }] }
|
|
],
|
|
normalization: { severity: commonSeverityMappings, status: commonStatusMappings, missingStatusOutcome: 'warning' },
|
|
presentation: {
|
|
titleHeaders: [/^CVE$/i],
|
|
severityHeaders: [/^Severity$/i],
|
|
sortHeaders: [/^Severity$/i],
|
|
sortDirection: 'desc',
|
|
defaultStatusFilter: 'deviation',
|
|
statusFilters: [
|
|
{ value: 'all', label: 'All Vulnerabilities', patterns: [] },
|
|
{ value: 'deviation', label: 'Vulnerabilities', patterns: [/^critical$/i, /^high$/i, /^medium$/i, /^low$/i] }
|
|
],
|
|
resultSectionHeaders: [/^Affected Devices$/i]
|
|
},
|
|
comparisonKeys: [['rule-id']]
|
|
};
|