You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Provide examples of how to generate a Selection Schema using one or more decision points for CVE Records usage #996
Is your feature request related to a problem? Please describe.
See CVE-schema PR CVEProject/cve-schema#460 where in discussion there is a request for a validated SSVC Selection Schema object can be generated with least possible errors and avoid potential hand -jammed values. @darakian requested.
Describe the solution you'd like
Provide pypi and JavaScript examples for providing SelectionSchema based objects.
While this is interesting, my concern is primarily for what data ends up in CVE records and the desire is to only have strongly typed values there. Unless the SSVC project is open to strictly typing namespaces and decision points I think my concerns are only relevant in the context of the CVE project.
Example code documented here with latest PR #1002 for features to create SSVC Selection records
from datetime import datetime, timezone
from ssvc.decision_tables.cisa.cisa_coordinate_dt import LATEST as decision_table
from ssvc import selection
namespace = "ssvc"
decision_points = ["Exploitation"]
values = [["Public PoC"]]
timestamp = datetime.now()
selections = []
for dp in decision_table.decision_points.values():
if dp.namespace == namespace and dp.name in decision_points:
dp_index = decision_points.index(dp.name)
selected = selection.Selection.from_decision_point(dp)
selected.values = tuple(selection.MinimalDecisionPointValue(key=val.key,name=val.name)
for val in dp.values if val.name in values[dp_index])
selections.append(selected)
out = selection.SelectionList(selections=selections,timestamp=timestamp)
print(out.model_dump_json(exclude_none=True, indent=4))
Activity
darakian commentedon Oct 7, 2025
While this is interesting, my concern is primarily for what data ends up in CVE records and the desire is to only have strongly typed values there. Unless the SSVC project is open to strictly typing namespaces and decision points I think my concerns are only relevant in the context of the CVE project.
sei-vsarvepalli commentedon Oct 7, 2025
Example code documented here with latest PR #1002 for features to create SSVC Selection records
/examples/*to basic FastAPI #1005ahouseholder commentedon Oct 10, 2025
@sei-vsarvepalli: Do you consider this issue resolved by the combination of
or is there more to do?
sei-vsarvepalli commentedon Oct 10, 2025
Yes those two are resolved. I can close this issues