pulumi-google-native-kotlin/com.pulumi.googlenative.containeranalysis.v1beta1.kotlin.outputs

Package-level declarations

Types

AliasContextResponse

data class AliasContextResponse(val kind: String, val name: String)

An alias to a repo revision.

AnalysisCompletedResponse

data class AnalysisCompletedResponse(val analysisType: List<String>)

Indicates which analysis completed successfully. Multiple types of analysis can be performed on a single resource.

ArtifactHashesResponse

data class ArtifactHashesResponse(val sha256: String)

Defines a hash object for use in Materials and Products.

ArtifactResponse

data class ArtifactResponse(val checksum: String, val names: List<String>)

Artifact describes a build product.

ArtifactRuleResponse

data class ArtifactRuleResponse(val artifactRule: List<String>)

Defines an object to declare an in-toto artifact rule

AssessmentResponse

data class AssessmentResponse(val cve: String, val impacts: List<String>, val justification: JustificationResponse, val longDescription: String, val relatedUris: List<RelatedUrlResponse>, val remediations: List<RemediationResponse>, val shortDescription: String, val state: String)

Assessment provides all information that is related to a single vulnerability for this product.

AttestationResponse

data class AttestationResponse(val genericSignedAttestation: GenericSignedAttestationResponse, val pgpSignedAttestation: PgpSignedAttestationResponse)

Occurrence that represents a single "attestation". The authenticity of an attestation can be verified using the attached signature. If the verifier trusts the public key of the signer, then verifying the signature is sufficient to establish trust. In this circumstance, the authority to which this attestation is attached is primarily useful for look-up (how to find this attestation if you already know the authority and artifact to be verified) and intent (which authority was this attestation intended to sign for).

AuthorityResponse

data class AuthorityResponse(val hint: HintResponse)

Note kind that represents a logical attestation "role" or "authority". For example, an organization might have one Authority for "QA" and one for "build". This note is intended to act strictly as a grouping mechanism for the attached occurrences (Attestations). This grouping mechanism also provides a security boundary, since IAM ACLs gate the ability for a principle to attach an occurrence to a given note. It also provides a single point of lookup to find all attached attestation occurrences, even if they don't all live in the same project.

BasisResponse

data class BasisResponse(val fingerprint: FingerprintResponse, val resourceUrl: String)

Basis describes the base image portion (Note) of the DockerImage relationship. Linked occurrences are derived from this or an equivalent image via: FROM Or an equivalent reference, e.g. a tag of the resource_url.

BindingResponse

data class BindingResponse(val condition: ExprResponse, val members: List<String>, val role: String)

Associates members, or principals, with a role.

BuildProvenanceResponse

data class BuildProvenanceResponse(val buildOptions: Map<String, String>, val builderVersion: String, val builtArtifacts: List<ArtifactResponse>, val commands: List<CommandResponse>, val createTime: String, val creator: String, val endTime: String, val logsUri: String, val project: String, val sourceProvenance: SourceResponse, val startTime: String, val triggerId: String)

Provenance of a build. Contains all information needed to verify the full details about the build from source to completion.

BuildResponse

data class BuildResponse(val builderVersion: String, val signature: BuildSignatureResponse)

Note holding the version of the provider's builder and the signature of the provenance message in the build details occurrence.

BuildSignatureResponse

data class BuildSignatureResponse(val keyId: String, val keyType: String, val publicKey: String, val signature: String)

Message encapsulating the signature of the verified build.

ByProductsResponse

data class ByProductsResponse(val customValues: Map<String, String>)

Defines an object for the byproducts field in in-toto links. The suggested fields are "stderr", "stdout", and "return-value".

CloudRepoSourceContextResponse

data class CloudRepoSourceContextResponse(val aliasContext: AliasContextResponse, val repoId: RepoIdResponse, val revisionId: String)

A CloudRepoSourceContext denotes a particular revision in a Google Cloud Source Repo.

CommandResponse

data class CommandResponse(val args: List<String>, val dir: String, val env: List<String>, val name: String, val waitFor: List<String>)

Command describes a step performed as part of the build pipeline.

CVSSResponse

data class CVSSResponse(val attackComplexity: String, val attackVector: String, val authentication: String, val availabilityImpact: String, val baseScore: Double, val confidentialityImpact: String, val exploitabilityScore: Double, val impactScore: Double, val integrityImpact: String, val privilegesRequired: String, val scope: String, val userInteraction: String)

Common Vulnerability Scoring System. This message is compatible with CVSS v2 and v3. For CVSS v2 details, see https://www.first.org/cvss/v2/guide CVSS v2 calculator: https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator For CVSS v3 details, see https://www.first.org/cvss/specification-document CVSS v3 calculator: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

CVSSv3Response

data class CVSSv3Response(val attackComplexity: String, val attackVector: String, val availabilityImpact: String, val baseScore: Double, val confidentialityImpact: String, val exploitabilityScore: Double, val impactScore: Double, val integrityImpact: String, val privilegesRequired: String, val scope: String, val userInteraction: String)

Deprecated. Common Vulnerability Scoring System version 3. For details, see https://www.first.org/cvss/specification-document

DeployableResponse

data class DeployableResponse(val resourceUri: List<String>)

An artifact that can be deployed in some runtime.

DeploymentResponse

data class DeploymentResponse(val address: String, val config: String, val deployTime: String, val platform: String, val resourceUri: List<String>, val undeployTime: String, val userEmail: String)

The period during which some deployable was active in a runtime.

DerivedResponse

data class DerivedResponse(val baseResourceUrl: String, val distance: Int, val fingerprint: FingerprintResponse, val layerInfo: List<LayerResponse>)

Derived describes the derived image portion (Occurrence) of the DockerImage relationship. This image would be produced from a Dockerfile with FROM .

DetailResponse

data class DetailResponse(val cpeUri: String, val description: String, val fixedLocation: VulnerabilityLocationResponse, val isObsolete: Boolean, val maxAffectedVersion: VersionResponse, val minAffectedVersion: VersionResponse, val package: String, val packageType: String, val severityName: String, val source: String, val sourceUpdateTime: String, val vendor: String)

Identifies all appearances of this vulnerability in the package for a specific distro/location. For example: glibc in cpe:/o:debian:debian_linux:8 for versions 2.1 - 2.2

DetailsResponse

data class DetailsResponse(val attestation: AttestationResponse)

Details of an attestation occurrence.

DigestResponse

data class DigestResponse(val algo: String, val digestBytes: String)

Digest information.

DiscoveredResponse

data class DiscoveredResponse(val analysisCompleted: AnalysisCompletedResponse, val analysisError: List<StatusResponse>, val analysisStatus: String, val analysisStatusError: StatusResponse, val continuousAnalysis: String, val lastAnalysisTime: String)

Provides information about the analysis status of a discovered resource.

DiscoveryResponse

data class DiscoveryResponse(val analysisKind: String)

A note that indicates a type of analysis a provider would perform. This note exists in a provider's project. A Discovery occurrence is created in a consumer's project at the start of analysis.

DistributionResponse

data class DistributionResponse(val architecture: String, val cpeUri: String, val description: String, val latestVersion: VersionResponse, val maintainer: String, val url: String)

This represents a particular channel of distribution for a given package. E.g., Debian's jessie-backports dpkg mirror.

DocumentNoteResponse

data class DocumentNoteResponse(val dataLicence: String, val spdxVersion: String)

DocumentNote represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/

DocumentOccurrenceResponse

data class DocumentOccurrenceResponse(val createTime: String, val creatorComment: String, val creators: List<String>, val documentComment: String, val externalDocumentRefs: List<String>, val licenseListVersion: String, val namespace: String, val title: String)

DocumentOccurrence represents an SPDX Document Creation Information section: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/

EnvelopeResponse

data class EnvelopeResponse(val payload: String, val payloadType: String, val signatures: List<EnvelopeSignatureResponse>)

MUST match https://github.com/secure-systems-lab/dsse/blob/master/envelope.proto. An authenticated message of arbitrary type.

EnvelopeSignatureResponse

data class EnvelopeSignatureResponse(val keyid: String, val sig: String)

EnvironmentResponse

data class EnvironmentResponse(val customValues: Map<String, String>)

Defines an object for the environment field in in-toto links. The suggested fields are "variables", "filesystem", and "workdir".

ExprResponse

data class ExprResponse(val description: String, val expression: String, val location: String, val title: String)

Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.

ExternalRefResponse

data class ExternalRefResponse(val category: String, val comment: String, val locator: String, val type: String)

An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package

FileNoteResponse

data class FileNoteResponse(val checksum: List<String>, val fileType: String, val title: String)

FileNote represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/

FileOccurrenceResponse

data class FileOccurrenceResponse(val attributions: List<String>, val comment: String, val contributors: List<String>, val copyright: String, val filesLicenseInfo: List<String>, val licenseConcluded: LicenseResponse, val notice: String)

FileOccurrence represents an SPDX File Information section: https://spdx.github.io/spdx-spec/4-file-information/

FingerprintResponse

data class FingerprintResponse(val v1Name: String, val v2Blob: List<String>, val v2Name: String)

A set of properties that uniquely identify a given Docker image.

GenericSignedAttestationResponse

data class GenericSignedAttestationResponse(val contentType: String, val serializedPayload: String, val signatures: List<SignatureResponse>)

An attestation wrapper that uses the Grafeas Signature message. This attestation must define the serialized_payload that the signatures verify and any metadata necessary to interpret that plaintext. The signatures should always be over the serialized_payload bytestring.

GerritSourceContextResponse

data class GerritSourceContextResponse(val aliasContext: AliasContextResponse, val gerritProject: String, val hostUri: String, val revisionId: String)

A SourceContext referring to a Gerrit project.

GetNoteIamPolicyResult

data class GetNoteIamPolicyResult(val bindings: List<BindingResponse>, val etag: String, val version: Int)

GetNoteResult

data class GetNoteResult(val attestationAuthority: AuthorityResponse, val baseImage: BasisResponse, val build: BuildResponse, val createTime: String, val deployable: DeployableResponse, val discovery: DiscoveryResponse, val expirationTime: String, val intoto: InTotoResponse, val kind: String, val longDescription: String, val name: String, val package: PackageResponse, val relatedNoteNames: List<String>, val relatedUrl: List<RelatedUrlResponse>, val sbom: DocumentNoteResponse, val sbomReference: SBOMReferenceNoteResponse, val shortDescription: String, val spdxFile: FileNoteResponse, val spdxPackage: PackageInfoNoteResponse, val spdxRelationship: RelationshipNoteResponse, val updateTime: String, val vulnerability: VulnerabilityResponse, val vulnerabilityAssessment: VulnerabilityAssessmentNoteResponse)

GetOccurrenceIamPolicyResult

data class GetOccurrenceIamPolicyResult(val bindings: List<BindingResponse>, val etag: String, val version: Int)

GetOccurrenceResult

data class GetOccurrenceResult(val attestation: DetailsResponse, val build: GrafeasV1beta1BuildDetailsResponse, val createTime: String, val deployment: GrafeasV1beta1DeploymentDetailsResponse, val derivedImage: GrafeasV1beta1ImageDetailsResponse, val discovered: GrafeasV1beta1DiscoveryDetailsResponse, val envelope: EnvelopeResponse, val installation: GrafeasV1beta1PackageDetailsResponse, val intoto: GrafeasV1beta1IntotoDetailsResponse, val kind: String, val name: String, val noteName: String, val remediation: String, val resource: ResourceResponse, val sbom: DocumentOccurrenceResponse, val sbomReference: SBOMReferenceOccurrenceResponse, val spdxFile: FileOccurrenceResponse, val spdxPackage: PackageInfoOccurrenceResponse, val spdxRelationship: RelationshipOccurrenceResponse, val updateTime: String, val vulnerability: GrafeasV1beta1VulnerabilityDetailsResponse)

GitSourceContextResponse

data class GitSourceContextResponse(val revisionId: String, val url: String)

A GitSourceContext denotes a particular revision in a third party Git repository (e.g., GitHub).

GrafeasV1beta1BuildDetailsResponse

data class GrafeasV1beta1BuildDetailsResponse(val provenance: BuildProvenanceResponse, val provenanceBytes: String)

Details of a build occurrence.

GrafeasV1beta1DeploymentDetailsResponse

data class GrafeasV1beta1DeploymentDetailsResponse(val deployment: DeploymentResponse)

Details of a deployment occurrence.

GrafeasV1beta1DiscoveryDetailsResponse

data class GrafeasV1beta1DiscoveryDetailsResponse(val discovered: DiscoveredResponse)

Details of a discovery occurrence.

GrafeasV1beta1ImageDetailsResponse

data class GrafeasV1beta1ImageDetailsResponse(val derivedImage: DerivedResponse)

Details of an image occurrence.

GrafeasV1beta1IntotoArtifactResponse

data class GrafeasV1beta1IntotoArtifactResponse(val hashes: ArtifactHashesResponse, val resourceUri: String)

GrafeasV1beta1IntotoDetailsResponse

data class GrafeasV1beta1IntotoDetailsResponse(val signatures: List<GrafeasV1beta1IntotoSignatureResponse>, val signed: LinkResponse)

This corresponds to a signed in-toto link - it is made up of one or more signatures and the in-toto link itself. This is used for occurrences of a Grafeas in-toto note.

GrafeasV1beta1IntotoSignatureResponse

data class GrafeasV1beta1IntotoSignatureResponse(val keyid: String, val sig: String)

A signature object consists of the KeyID used and the signature itself.

GrafeasV1beta1PackageDetailsResponse

data class GrafeasV1beta1PackageDetailsResponse(val installation: InstallationResponse)

Details of a package occurrence.

GrafeasV1beta1VulnerabilityDetailsResponse

data class GrafeasV1beta1VulnerabilityDetailsResponse(val cvssScore: Double, val cvssV2: CVSSResponse, val cvssV3: CVSSResponse, val cvssVersion: String, val effectiveSeverity: String, val longDescription: String, val packageIssue: List<PackageIssueResponse>, val relatedUrls: List<RelatedUrlResponse>, val severity: String, val shortDescription: String, val type: String, val vexAssessment: VexAssessmentResponse)

Details of a vulnerability Occurrence.

HashResponse

data class HashResponse(val type: String, val value: String)

Container message for hash values.

HintResponse

data class HintResponse(val humanReadableName: String)

This submessage provides human-readable hints about the purpose of the authority. Because the name of a note acts as its resource reference, it is important to disambiguate the canonical name of the Note (which might be a UUID for security purposes) from "readable" names more suitable for debug output. Note that these hints should not be used to look up authorities in security sensitive contexts, such as when looking up attestations to verify.

InstallationResponse

data class InstallationResponse(val architecture: String, val cpeUri: String, val license: LicenseResponse, val location: List<LocationResponse>, val name: String, val packageType: String, val version: VersionResponse)

This represents how a particular software package may be installed on a system.

InTotoResponse

data class InTotoResponse(val expectedCommand: List<String>, val expectedMaterials: List<ArtifactRuleResponse>, val expectedProducts: List<ArtifactRuleResponse>, val signingKeys: List<SigningKeyResponse>, val stepName: String, val threshold: String)

This contains the fields corresponding to the definition of a software supply chain step in an in-toto layout. This information goes into a Grafeas note.

JustificationResponse

data class JustificationResponse(val details: String, val justificationType: String)

Justification provides the justification when the state of the assessment if NOT_AFFECTED.

KnowledgeBaseResponse

data class KnowledgeBaseResponse(val name: String, val url: String)

LayerResponse

data class LayerResponse(val arguments: String, val directive: String)

Layer holds metadata specific to a layer of a Docker image.

LicenseResponse

data class LicenseResponse(val comments: String, val expression: String)

License information.

LinkResponse

data class LinkResponse(val byproducts: ByProductsResponse, val command: List<String>, val environment: EnvironmentResponse, val materials: List<GrafeasV1beta1IntotoArtifactResponse>, val products: List<GrafeasV1beta1IntotoArtifactResponse>)

This corresponds to an in-toto link.

LocationResponse

data class LocationResponse(val cpeUri: String, val path: String, val version: VersionResponse)

An occurrence of a particular package installation found within a system's filesystem. E.g., glibc was found in /var/lib/dpkg/status.

PackageInfoNoteResponse

data class PackageInfoNoteResponse(val analyzed: Boolean, val attribution: String, val checksum: String, val copyright: String, val detailedDescription: String, val downloadLocation: String, val externalRefs: List<ExternalRefResponse>, val filesLicenseInfo: List<String>, val homePage: String, val licenseDeclared: LicenseResponse, val originator: String, val packageType: String, val summaryDescription: String, val supplier: String, val title: String, val verificationCode: String, val version: String)

PackageInfoNote represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/

PackageInfoOccurrenceResponse

data class PackageInfoOccurrenceResponse(val comment: String, val filename: String, val homePage: String, val licenseConcluded: LicenseResponse, val packageType: String, val sourceInfo: String, val summaryDescription: String, val title: String, val version: String)

PackageInfoOccurrence represents an SPDX Package Information section: https://spdx.github.io/spdx-spec/3-package-information/

PackageIssueResponse

data class PackageIssueResponse(val affectedLocation: VulnerabilityLocationResponse, val effectiveSeverity: String, val fixedLocation: VulnerabilityLocationResponse, val packageType: String, val severityName: String)

This message wraps a location affected by a vulnerability and its associated fix (if one is available).

PackageResponse

data class PackageResponse(val architecture: String, val cpeUri: String, val description: String, val digest: List<DigestResponse>, val distribution: List<DistributionResponse>, val license: LicenseResponse, val maintainer: String, val name: String, val packageType: String, val url: String, val version: VersionResponse)

Package represents a particular package version.

PgpSignedAttestationResponse

data class PgpSignedAttestationResponse(val contentType: String, val pgpKeyId: String, val signature: String)

An attestation wrapper with a PGP-compatible signature. This message only supports ATTACHED signatures, where the payload that is signed is included alongside the signature itself in the same file.

ProductResponse

data class ProductResponse(val genericUri: String, val name: String)

Product contains information about a product and how to uniquely identify it.

ProjectRepoIdResponse

data class ProjectRepoIdResponse(val project: String, val repoName: String)

Selects a repo using a Google Cloud Platform project ID (e.g., winged-cargo-31) and a repo name within that project.

PublisherResponse

data class PublisherResponse(val issuingAuthority: String, val name: String, val publisherNamespace: String)

Publisher contains information about the publisher of this Note.

RelatedUrlResponse

data class RelatedUrlResponse(val label: String, val url: String)

Metadata for any related URL information.

RelationshipNoteResponse

data class RelationshipNoteResponse(val type: String)

RelationshipNote represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/

RelationshipOccurrenceResponse

data class RelationshipOccurrenceResponse(val comment: String, val source: String, val target: String, val type: String)

RelationshipOccurrence represents an SPDX Relationship section: https://spdx.github.io/spdx-spec/7-relationships-between-SPDX-elements/

RemediationResponse

data class RemediationResponse(val details: String, val remediationType: String, val remediationUri: RelatedUrlResponse)

Specifies details on how to handle (and presumably, fix) a vulnerability.

RepoIdResponse

data class RepoIdResponse(val projectRepoId: ProjectRepoIdResponse, val uid: String)

A unique identifier for a Cloud Repo.

ResourceResponse

data class ResourceResponse(val contentHash: HashResponse, val name: String, val uri: String)

An entity that can have metadata. For example, a Docker image.

SbomReferenceIntotoPayloadResponse

data class SbomReferenceIntotoPayloadResponse(val predicate: SbomReferenceIntotoPredicateResponse, val predicateType: String, val subject: List<SubjectResponse>, val type: String)

The actual payload that contains the SBOM Reference data. The payload follows the intoto statement specification. See https://github.com/in-toto/attestation/blob/main/spec/v1.0/statement.md for more details.

SbomReferenceIntotoPredicateResponse

data class SbomReferenceIntotoPredicateResponse(val digest: Map<String, String>, val location: String, val mimeType: String, val referrerId: String)

A predicate which describes the SBOM being referenced.

SBOMReferenceNoteResponse

data class SBOMReferenceNoteResponse(val format: String, val version: String)

The note representing an SBOM reference.

SBOMReferenceOccurrenceResponse

data class SBOMReferenceOccurrenceResponse(val payload: SbomReferenceIntotoPayloadResponse, val payloadType: String, val signatures: List<EnvelopeSignatureResponse>)

The occurrence representing an SBOM reference as applied to a specific resource. The occurrence follows the DSSE specification. See https://github.com/secure-systems-lab/dsse/blob/master/envelope.md for more details.

SignatureResponse

data class SignatureResponse(val publicKeyId: String, val signature: String)

Verifiers (e.g. Kritis implementations) MUST verify signatures with respect to the trust anchors defined in policy (e.g. a Kritis policy). Typically this means that the verifier has been configured with a map from public_key_id to public key material (and any required parameters, e.g. signing algorithm). In particular, verification implementations MUST NOT treat the signature public_key_id as anything more than a key lookup hint. The public_key_id DOES NOT validate or authenticate a public key; it only provides a mechanism for quickly selecting a public key ALREADY CONFIGURED on the verifier through a trusted channel. Verification implementations MUST reject signatures in any of the following circumstances: * The public_key_id is not recognized by the verifier. * The public key that public_key_id refers to does not verify the signature with respect to the payload. The signature contents SHOULD NOT be "attached" (where the payload is included with the serialized signature bytes). Verifiers MUST ignore any "attached" payload and only verify signatures with respect to explicitly provided payload (e.g. a payload field on the proto message that holds this Signature, or the canonical serialization of the proto message that holds this signature).

SigningKeyResponse

data class SigningKeyResponse(val keyId: String, val keyScheme: String, val keyType: String, val publicKeyValue: String)

This defines the format used to record keys used in the software supply chain. An in-toto link is attested using one or more keys defined in the in-toto layout. An example of this is: { "key_id": "776a00e29f3559e0141b3b096f696abc6cfb0c657ab40f441132b345b0...", "key_type": "rsa", "public_key_value": "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0B...", "key_scheme": "rsassa-pss-sha256" } The format for in-toto's key definition can be found in section 4.2 of the in-toto specification.

SourceContextResponse

data class SourceContextResponse(val cloudRepo: CloudRepoSourceContextResponse, val gerrit: GerritSourceContextResponse, val git: GitSourceContextResponse, val labels: Map<String, String>)

A SourceContext is a reference to a tree of files. A SourceContext together with a path point to a unique revision of a single file or directory.

SourceResponse

data class SourceResponse(val additionalContexts: List<SourceContextResponse>, val artifactStorageSourceUri: String, val context: SourceContextResponse, val fileHashes: Map<String, String>)

Source describes the location of the source used for the build.

StatusResponse

data class StatusResponse(val code: Int, val details: List<Map<String, String>>, val message: String)

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.

SubjectResponse

data class SubjectResponse(val digest: Map<String, String>, val name: String)

Set of software artifacts that the attestation applies to. Each element represents a single software artifact.

VersionResponse

data class VersionResponse(val epoch: Int, val inclusive: Boolean, val kind: String, val name: String, val revision: String)

Version contains structured information about the version of a package.

VexAssessmentResponse

data class VexAssessmentResponse(val cve: String, val impacts: List<String>, val justification: JustificationResponse, val noteName: String, val relatedUris: List<RelatedUrlResponse>, val remediations: List<RemediationResponse>, val state: String)

VexAssessment provides all publisher provided Vex information that is related to this vulnerability.

VulnerabilityAssessmentNoteResponse

data class VulnerabilityAssessmentNoteResponse(val assessment: AssessmentResponse, val languageCode: String, val longDescription: String, val product: ProductResponse, val publisher: PublisherResponse, val shortDescription: String, val title: String)

A single VulnerabilityAssessmentNote represents one particular product's vulnerability assessment for one CVE.

VulnerabilityLocationResponse

data class VulnerabilityLocationResponse(val cpeUri: String, val package: String, val version: VersionResponse)

The location of the vulnerability.

VulnerabilityResponse

data class VulnerabilityResponse(val cvssScore: Double, val cvssV2: CVSSResponse, val cvssV3: CVSSv3Response, val cvssVersion: String, val cwe: List<String>, val details: List<DetailResponse>, val severity: String, val sourceUpdateTime: String, val windowsDetails: List<WindowsDetailResponse>)

Vulnerability provides metadata about a security vulnerability in a Note.

WindowsDetailResponse

data class WindowsDetailResponse(val cpeUri: String, val description: String, val fixingKbs: List<KnowledgeBaseResponse>, val name: String)