Merge branch 'main' into mobile_device

Signed-off-by: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com>

CHANGELOG.md

@@ -42,18 +42,17 @@ Thankyou! -->
 ## [Unreleased]
 
 ### Added
-* #### Dictionary Attributes
+* #### Dictionary Attributes 
   1. Added `boot_uid` as a `string_t`. [#1335](https://github.com/ocsf/ocsf-schema/pull/1335)
   1. Added `raw_data_size` as a `long_t`. [#1347](https://github.com/ocsf/ocsf-schema/pull/1347)
   1. Added `assessments` as an array of `assessment` objects. #1343
   1. Added `meets_criteria` as a `boolean_t`. #1343
   1. Added `display_name` attribute as a `string_t`. [#1341](https://github.com/ocsf/ocsf-schema/pull/1341)
   1. Added `is_directed` as a `boolean_t`, `relation` as a `string_t`, `query_language` & `query_language_id` a sibling pair. #1343
   1. Added `resource_relationship` of type `graph`, `nodes` of type `node`, `edges` of type `edge`. #1343
-  1. Added `meets_criteria` as a `boolean_t`. #1343
+  1. Added `fix_coverage` as `string_t` and `fix_coverage_id` as `int_t`. #1350
   1. Added `eid`, `iccid`, and `meid` as `string_t`. #1346
   1. Added `is_backed_up`, `is_mobile_account_active`, and `is_shared` as `boolean_t`. #1346
-
 * #### Objects
   1. Added `assessment` object to capture evaluations/assessments of configurations/signals. #1343
   1. Added `node`, `edge`, `graph` objects. #1343
@@ -71,9 +70,9 @@ Thankyou! -->
   1. Added `data` to `policy` object. #1343
   1. Added `display_name` attribute to the `user` and `ldap_person` objects. [#1341](https://github.com/ocsf/ocsf-schema/pull/1341)
   1. Added `resource_relationship` to `resource_details` object. #1343
+  1. Added `fix_coverage`, `fix_coverage_id` to `vulnerability` object. #1350
   1. Added `eid`, `iccid`, `is_backed_up`, `is_mobile_account_active`, `is_shared`, and `meid` to `device`. #1346
   1. Added `is_backed_up` to `resource_details`. #1346
-
 ### Misc
   1. Updated description of `config_state` to reflect the addition of the `assessments` object. #1343
 

dictionary.json

@@ -2327,6 +2327,26 @@
         "since": "1.1.0"
       }
     },
+    "fix_coverage": {
+      "caption": "Fix Coverage",
+      "description": "The fix coverage, normalized to the caption of the <code>fix_coverage_id</code> value. See specific usage.",
+      "type": "string_t"
+    },
+    "fix_coverage_id": {
+      "caption": "Fix Coverage ID",
+      "description": "The normalized identifier for fix coverage. See specific usage.",
+      "type": "integer_t",
+      "enum":{
+        "0": {
+          "caption": "Unknown",
+          "description": "The fix coverage is unknown."
+        },
+        "99": {
+          "caption": "Other",
+          "description": "The fix coverage is not mapped. See the <code>fix_coverage</code> attribute, which contains a data source specific value."
+        }
+      }
+    },
     "fixed_in_version": {
       "caption": "Fixed In Version",
       "description": "The software package version in which a reported vulnerability was patched/fixed.",

objects/vulnerability.json

@@ -35,6 +35,28 @@
     "fix_available": {
       "requirement": "optional"
     },
+    "fix_coverage": {
+      "description": "The fix coverage, normalized to the caption of the <code>fix_coverage_id</code> value.",
+      "requirement": "optional"
+    },
+    "fix_coverage_id": {
+      "description": "The normalized identifier for fix coverage, applicable to this vulnerability. Typically useful, when there are multiple affected packages but only a subset have available fixes.",
+      "requirement": "optional",
+      "enum":{
+        "1": {
+          "caption": "Complete",
+          "description": "All affected packages and components have available fixes or patches to remediate the vulnerability."
+        },
+        "2": {
+          "caption": "Partial", 
+          "description": "Only some of the affected packages and components have available fixes or patches, while others remain vulnerable."
+        },
+        "3": {
+          "caption": "None",
+          "description": "No fixes or patches are currently available for any of the affected packages and components."
+        }
+      }
+    },
     "is_exploit_available": {
       "requirement": "optional"
     },