Severity and taxonomy

A finding carries several classifications. Some the agent writes, some the application derives, and one exists only in the exports. This page takes them one at a time.

Classification	Source	Checked by the application
Severity	Agent	Must be one of five values
CVSS score and vector	Agent, optional	No
CVE ids	Agent, optional	No
CWE ids	Derived from keywords at export time	—
ATT&CK technique ids	Agent	Against the shipped ATT&CK manifest
ATT&CK tactic ids	Derived from the technique ids	—
WSTG ids	Agent, optional	No
NIST test category	Agent	Must be one of four values

Severity¶

Five values, from most to least severe: critical, high, medium, low, info. The agent sets severity when it adds a finding and can change it later in the run with update_finding. The PDF, the CSV and the SARIF result's properties keep all five. SARIF's own level field has three values, and SARIF and CSV exports describes how the five map onto them.

CVSS¶

cvss_score is a number and cvss_vector is a string. Both are optional, both are written by the agent, and update_finding can change either. The application does not compute a score, does not parse the vector, and does not check the score's range or its agreement with the vector or the severity. A score of 42 with a vector that is not CVSS syntax is stored as given, and the PDF and the exports print it as given. The console shows the score to one decimal place.

The agent's prompts ask for a score and a vector on every finding of severity medium and above. That is an instruction to the model; no code enforces it.

The console's finding list and the PDF show the score, and the PDF adds the vector in brackets. The CSV has the score only. SARIF carries both.

CVE¶

cves is a list of strings written by the agent. The application does not check their format or look them up. They appear in the console, in the PDF under the finding and in its crosswalk, in the CSV cve column and in SARIF.

CWE¶

Findings have no CWE field. The CWE ids in the exports are derived when the export is built, from the same keyword categories the framework mapping falls back on. The application lowercases a finding's title, description and the content of its evidence items, and tests that text against sixteen categories, each a short list of substrings and regular expressions. Fourteen categories carry a CWE id:

Category	CWE
sql_injection	CWE-89
xss	CWE-79
command_injection	CWE-78
code_injection	CWE-94
open_port	CWE-1327
default_credentials	CWE-1392
weak_credentials	CWE-521
privilege_escalation	CWE-269
outdated_software	CWE-1104
ssl_tls_issue	CWE-326
data_exposure	CWE-200
misconfiguration	CWE-16
authentication_bypass	CWE-287
information_disclosure	CWE-200

The other two, cve and malware, have none. A finding whose text matches only those two, or matches no category, exports an empty CWE cell. A finding that matches several categories exports their CWE ids in the table's order, without repeats.

The derivation reads the words in the finding, not its ATT&CK or WSTG ids, and a matching word anywhere in the evidence output is enough. Treat an exported CWE id as a hint.

The PDF does not print CWE ids.

ATT&CK techniques and tactics¶

The agent is asked for MITRE ATT&CK technique ids on every finding. When it supplies them, add_finding checks every id against the manifest shipped with the application. One unknown id blocks the call: the finding is not recorded, and the agent is told which ids were unknown. An empty list passes the check. Technique ids can be set only when the finding is added; update_finding does not take them.

Tactic ids are not written by the agent. The application looks up the tactics of every accepted technique in the same manifest and stores the sorted set.

The PDF prints technique ids under the finding, in the crosswalk and in the attack chain, and counts both techniques and tactics in the ATT&CK heatmap. The CSV has technique ids. SARIF has both.

WSTG¶

wstg_ids is an optional list of OWASP Web Security Testing Guide ids written by the agent in add_finding. The application does not check them against any list. A finding for which the agent sent no list stores nothing, and one for which it sent an empty list stores an empty list; every report output treats the two the same way, as no ids.

Control ids¶

Technique ids and WSTG ids are what connect a finding to the controls of the engagement's framework. Frameworks describes the tables and the keyword fallback.

NIST test category¶

Every finding carries one of four NIST SP 800-115 test categories, written by the agent: network_scanning, vuln_scanning, password_cracking, pen_testing.

The PDF's Test Results section has one subsection per category. The report model names its four fields differently from the enum values, and the report generator connects them by filling each field from one category:

Enum value	Report field	PDF heading
network_scanning	network_scanning	Network Scanning
vuln_scanning	vulnerability_scanning	Vulnerability Scanning
password_cracking	password_cracking	Password Cracking
pen_testing	penetration_testing	Penetration Testing

A subsection holds a fixed objective sentence for its category, the findings in that category by short id, and their counts by severity. When the run's tools list is not empty, it also prints Methods Used, which is that whole list — the first word of every command in the findings' evidence — repeated unchanged in all four subsections. It does not say which tools served which category.