|
40 | 40 | description="The publish outcome group.", |
41 | 41 | version="1.0.0", |
42 | 42 | outcomes=( |
43 | | - OutcomeValue(name="Do Not Publish", key="N", description="Do Not Publish"), |
| 43 | + OutcomeValue( |
| 44 | + name="Do Not Publish", key="N", description="Do Not Publish" |
| 45 | + ), |
44 | 46 | OutcomeValue(name="Publish", key="P", description="Publish"), |
45 | 47 | ), |
46 | 48 | ) |
|
107 | 109 | The CVSS outcome group. |
108 | 110 | """ |
109 | 111 |
|
110 | | -CISA_1 = OutcomeGroup( |
| 112 | +CISA = OutcomeGroup( |
111 | 113 | name="CISA Levels", |
112 | 114 | description="The CISA outcome group. " |
113 | 115 | "CISA uses its own SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: Track, Track*, Attend, and Act.", |
|
122 | 124 | ), |
123 | 125 | OutcomeValue( |
124 | 126 | name="Track*", |
125 | | - key="R", |
| 127 | + key="T*", |
126 | 128 | description="The vulnerability contains specific characteristics that may require closer monitoring for changes. " |
127 | 129 | "CISA recommends remediating Track* vulnerabilities within standard update timelines.", |
128 | 130 | ), |
|
135 | 137 | ), |
136 | 138 | OutcomeValue( |
137 | 139 | name="Act", |
138 | | - key="C", |
139 | | - description="The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. " |
140 | | - "Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. " |
141 | | - "Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. " |
142 | | - "CISA recommends remediating Act vulnerabilities as soon as possible.", |
143 | | - ), |
144 | | - ), |
145 | | -) |
146 | | -""" |
147 | | -The CISA outcome group. Based on CISA's customizations of the SSVC model. |
148 | | -See https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc |
149 | | -""" |
150 | | - |
151 | | -CISA = OutcomeGroup( |
152 | | - name="CISA Levels", |
153 | | - description="The CISA outcome group. " |
154 | | - "CISA uses its own SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: Track, Monitor, Attend, and Act.", |
155 | | - version="1.1.0", |
156 | | - outcomes=( |
157 | | - OutcomeValue( |
158 | | - name="Track", |
159 | | - key="T", |
160 | | - description="The vulnerability does not require action at this time. " |
161 | | - "The organization would continue to track the vulnerability and reassess it if new information becomes available. " |
162 | | - "CISA recommends remediating Track vulnerabilities within standard update timelines.", |
163 | | - ), |
164 | | - OutcomeValue( |
165 | | - name="Monitor", |
166 | | - key="M", |
167 | | - description="The vulnerability contains specific characteristics that may require closer monitoring for changes. " |
168 | | - "CISA recommends remediating Monitor vulnerabilities within standard update timelines.", |
169 | | - ), |
170 | | - OutcomeValue( |
171 | | - name="Attend", |
172 | 140 | key="A", |
173 | | - description="The vulnerability requires attention from the organization's internal, supervisory-level individuals. " |
174 | | - "Necessary actions may include requesting assistance or information about the vulnerability and may involve publishing a notification, either internally and/or externally, about the vulnerability. " |
175 | | - "CISA recommends remediating Attend vulnerabilities sooner than standard update timelines.", |
176 | | - ), |
177 | | - OutcomeValue( |
178 | | - name="Act", |
179 | | - key="C", |
180 | 141 | description="The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. " |
181 | 142 | "Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. " |
182 | 143 | "Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. " |
|
189 | 150 | See https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc |
190 | 151 | """ |
191 | 152 |
|
192 | | - |
193 | 153 | YES_NO = OutcomeGroup( |
194 | 154 | name="Yes, No", |
195 | 155 | description="The Yes/No outcome group.", |
|
210 | 170 | outcomes=( |
211 | 171 | # drop, reconsider later, easy win, do first |
212 | 172 | OutcomeValue(name="Drop", key="D", description="Drop"), |
213 | | - OutcomeValue(name="Reconsider Later", key="R", description="Reconsider Later"), |
| 173 | + OutcomeValue( |
| 174 | + name="Reconsider Later", key="R", description="Reconsider Later" |
| 175 | + ), |
214 | 176 | OutcomeValue(name="Easy Win", key="E", description="Easy Win"), |
215 | 177 | OutcomeValue(name="Do First", key="F", description="Do First"), |
216 | 178 | ), |
|
225 | 187 | version="1.0.0", |
226 | 188 | outcomes=( |
227 | 189 | OutcomeValue(name="Track 5", key="5", description="Track"), |
228 | | - OutcomeValue(name="Track Closely 4", key="4", description="Track Closely"), |
| 190 | + OutcomeValue( |
| 191 | + name="Track Closely 4", key="4", description="Track Closely" |
| 192 | + ), |
229 | 193 | OutcomeValue(name="Attend 3", key="3", description="Attend"), |
230 | 194 | OutcomeValue(name="Attend 2", key="2", description="Attend"), |
231 | 195 | OutcomeValue(name="Act 1", key="1", description="Act"), |
|
0 commit comments