Catalog reference

Every table below is generated from catalog v5, the same manifest the server validates writes against. kb_types returns the identical contract and the same descriptions at runtime and is the source to read from a client; this page exists so the contract is reviewable without a running server. Regenerate it with make docs-catalog.

The catalog declares 35 node types and 52 relation types. Conventions that the catalog does not enforce, and the longer reasoning behind each type, live in Graph and search.

What a write is checked against

Gate	Declared in	Rejects
Type name	nodes / relations keys	An unknown type, on write and on schema lookup.
Required properties	required map	A missing required property, or one whose value fails its rule.
Optional properties	optional map	A declared optional property that is null or whose value fails its rule. An absent one is accepted, and properties outside both maps are stored as submitted and are not validated.
Format rule	formats, the validator, and the discovery schema	A value that does not match the published spelling. A rule missing from any of the three places would silently weaken the contract, so a test pins all three.
Identity	identity.properties	A later write that changes an identity property of an existing record.
Inventory	inventory per node type	A new node of a carries type without an ownership state, an ownership outside the type's allowed_ownership, and inventory state on a type whose declaration does not allow it.
Parent scope	identity.scope	A new scoped node without exactly one scope relation in the same write, a re-parenting attempt, and a parent or scope-relation delete while the child exists.
Endpoint types	sources, targets, self_edge	A relation between node types it does not connect, and a self edge where none is allowed.
Checks	checks ids per type	Two properties that individually pass but disagree, and a relation whose endpoints' stored values do not actually stand in it.
Canonicalization	canonicalize ids per type	Nothing: a declared non-canonical spelling is rewritten before validation, identity and storage.

Shared limits

Setting	Value	Meaning
additional_properties	true	Properties outside the declared maps are accepted and stored unvalidated.
coercion	false	No JSON type is converted. A string "443" is not an integer.
depth	16	Maximum nesting depth of the properties object.
integers	signed64	Integers outside signed 64-bit are rejected.
numbers	finite double	NaN and infinity are rejected.
optional_nonnull	true	A declared optional property may be absent but never null; clear one with remove_properties.
properties_bytes	65536	Maximum size of one canonical properties object, in UTF-8 bytes.
required_nonnull	true	A required property may not be null or absent.

Inventory state

Every node type declares inventory, which says whether its nodes hold ownership and authorization. Both are server-managed fields outside properties. Ownership is one of owned, dependency, candidate, rejected, and authorization is one of in_scope, out_of_scope, unknown. Only in_scope authorizes active testing; owned and unknown do not. The server performs no testing, so the agent enforces this rule.

Declaration	Meaning
carries	The node holds its own ownership and authorization. A type that lists allowed_ownership accepts only those ownership values.
inherits	The node is parent-scoped and inherits ownership and authorization from its parent-scope chain, which ends at a node that carries them.
none	A vocabulary or shared record: the node holds no ownership or authorization.

Bundled registries

dns_name classifies names against the bundled ICANN public suffix list, and service_name accepts the bundled service whitelist. The SHA-256 of each registry's parsed content is part of the fingerprinted contract, so refreshing either refuses workspaces written under the old one.

Registry	Parsed-content SHA-256
public_suffix_list	8fb96dafe8035fe8b7a98bc7f532fb885c20c92397782f75fec60979f4dc6fca
service_names	12ceb1efcec0b70c784e5764d88034a2fb7b159320b9c867514e454b5483f276

Node types

Identity is what makes two writes the same node. A parent scope adds the parent's UUID to that identity, so the same properties under two parents are two nodes.

Node	Identity	Parent scope	Inventory	Required properties
advisory	value	—	none	value: advisory_id
asn	value	—	carries	value: asn
certificate	der_sha256	—	carries	der_sha256: sha256
cloud_account	provider, account_id	—	carries	account_id: cloud_account_id provider: one of aws, gcp, azure
cloud_resource	hostname	—	carries	hostname: dns_name service: one of aws_cloudfront, aws_api_gateway, aws_lambda_url, aws_elastic_beanstalk, aws_elb, azure_app_service, azure_cloud_service, azure_public_ip, azure_traffic_manager, azure_front_door, azure_api_management, gcp_app_engine, gcp_firebase_hosting, gcp_firebase_rtdb
cwe	value	—	none	value: cwe
dkim_record	selector	has_dkim_selector (source)	inherits	selector: dkim_selector value: txt_value
dmarc_record	value	—	none	value: dmarc
domain	value	—	carries	value: dns_name
email_address	value	—	carries	value: email_address
endpoint	url, method	—	carries	method: method url: http_url
finding	rule, matcher	has_finding (source)	inherits	matcher: finding_matcher_or_empty rule: finding_rule severity: one of info, low, medium, high, critical, unknown title: printable_text_200
host_key	algorithm, fingerprint_sha256	—	carries	algorithm: one of ssh-rsa, ssh-dss, ssh-ed25519, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com fingerprint_sha256: sha256
http_fingerprint	kind, value	—	none	kind: one of favicon_mmh3, body_sha256, header_sha256 value: http_fingerprint_value
identity_tenant	provider, tenant_id	—	carries	provider: one of entra_id, okta tenant_id: tenant_id
ip_address	value	—	carries	value: ip version: ip_version
ip_cidr	value	—	carries	value: cidr version: ip_version
mta_sts_policy	value	has_mta_sts_policy (source)	inherits	value: mta_sts
organization	registry, handle	—	carries	handle: rir_handle registry: one of arin, ripe, apnic, lacnic, afrinic
package	purl	—	carries	purl: package_purl
parameter	name, location	has_parameter (source)	inherits	location: one of query, body, header, cookie, path name: parameter_name
phone	value	—	carries	value: phone_e164
port	transport, number	has_open_port (source)	inherits	number: uint16 transport: one of tcp, udp, sctp
registrar	iana_id	—	none	iana_id: uint16 name: printable_text_200
repository	host, owner, name	—	carries	host: dns_name name: repo_name owner: repo_owner platform: one of github, gitlab, bitbucket, gitea
secret	value_sha256	—	carries	value_sha256: sha256
service	name	has_service (source)	inherits	name: service_name
spf_record	value	—	none	value: spf
storage_bucket	provider, name	—	carries	name: bucket_name provider: one of aws_s3, gcp_gcs, azure_blob
subdomain	value	—	carries	value: dns_name
technology	name	—	none	name: tech_token
tls_cipher_suite	version, name	—	none	name: tls_cipher_name version: one of ssl30, tls10, tls11, tls12, tls13, dtls10, dtls12, dtls13
tls_fingerprint	kind, value	—	none	kind: one of jarm, ja3s value: tls_fingerprint_value
txt_record	value	—	none	value: txt_value
whois_registration	registry, registry_domain_id	has_registration (source)	inherits	registry: public_suffix registry_domain_id: registry_domain_id

Relation types

A relation's identity is scoped to its endpoints: two edges of one type between one pair of nodes are the same edge unless an identity property differs.

Relation	Sources	Targets	Self edge	Identity	Required properties
affected_by	service, finding, endpoint, package	advisory	no	—	—
aliases	advisory	advisory	no	—	—
announced_by	ip_cidr	asn	no	—	—
authenticates	secret	email_address, cloud_account, identity_tenant, repository, service, endpoint, storage_bucket, cloud_resource	no	username, breach	breach: breach_token_or_empty username: username_or_empty
backed_by_bucket	domain, subdomain, endpoint	storage_bucket	no	—	—
caa_issue	domain, subdomain	domain, subdomain	yes	flags, parameters, with parameters hashed order-independently	flags: uint8 parameters: caa_parameters
caa_issuewild	domain, subdomain	domain, subdomain	yes	flags, parameters, with parameters hashed order-independently	flags: uint8 parameters: caa_parameters
cname_to	domain, subdomain	domain, subdomain	yes	—	—
contains_cidr	ip_cidr	ip_cidr	no	—	—
contains_ip	ip_cidr	ip_address	no	—	—
covers_name	certificate	domain, subdomain	no	coverage	coverage: one of exact, wildcard
dname_to	domain, subdomain	domain, subdomain	yes	—	—
exposes_secret	repository, endpoint, storage_bucket, cloud_resource, package	secret	no	location	location: printable_text_1024
federates_with	domain, subdomain	identity_tenant	no	—	—
has_contact	organization, registrar, domain, subdomain, repository, whois_registration, package	email_address, phone, endpoint	no	role	role: one of abuse, admin, tech, registrant, billing, noc, security, published, iodef, maintainer
has_dkim_selector	domain, subdomain	dkim_record	no	—	—
has_dmarc	domain, subdomain	dmarc_record	no	—	—
has_finding	port, domain, subdomain, ip_address, ip_cidr, service, endpoint, certificate, parameter, dkim_record, storage_bucket, repository, identity_tenant, secret, mta_sts_policy, whois_registration, cloud_account, cloud_resource, package	finding	no	—	—
has_http_fingerprint	endpoint	http_fingerprint	no	—	—
has_mail_exchange	domain, subdomain	domain, subdomain	yes	preference	preference: uint16
has_mta_sts_policy	domain, subdomain	mta_sts_policy	no	—	—
has_nameserver	domain, subdomain	domain, subdomain	yes	—	—
has_open_port	ip_address	port	no	—	—
has_parameter	endpoint	parameter	no	—	—
has_registration	domain	whois_registration	no	—	—
has_service	port	service	no	—	—
has_soa_primary	domain, subdomain	domain, subdomain	yes	—	—
has_spf	domain, subdomain	spf_record	no	—	—
has_srv_target	domain, subdomain	domain, subdomain	yes	service, protocol, port, priority, weight	port: uint16 priority: uint16 protocol: srv_label service: srv_label weight: uint16
has_subdomain	domain, subdomain	subdomain	no	—	—
has_svcb_binding	domain, subdomain	domain, subdomain	yes	record_type, priority, alpn, with alpn hashed order-independently	alpn: alpn_tokens priority: uint16 record_type: one of https, svcb
has_tls_fingerprint	service	tls_fingerprint	no	—	—
has_txt_record	domain, subdomain	txt_record	no	—	—
has_weakness	finding, advisory	cwe	no	—	—
hosted_on	domain, subdomain, endpoint	cloud_resource	no	—	—
in_account	cloud_resource, storage_bucket, package	cloud_account	no	—	—
issued_by	certificate	certificate	yes	—	—
links_to	endpoint	endpoint	yes	element	element: html_token_or_empty
loads_package	endpoint	package	no	—	—
operated_by	asn, ip_cidr	organization	no	—	—
owns_repository	domain, subdomain	repository	no	—	—
presents_certificate	service	certificate	no	mode, server_name, alpn_offered, with alpn_offered hashed order-independently	alpn_offered: alpn_tokens mode: one of tls, dtls, starttls, quic server_name: dns_or_explicit_empty
presents_host_key	service	host_key	no	—	—
protected_by	service, endpoint, domain, subdomain	technology	no	kind	kind: one of waf, cdn, reverse_proxy, load_balancer
published_from	package	repository	no	—	—
redirects_to	endpoint	endpoint	yes	status	status: redirect_status
registered_through	whois_registration	registrar	no	—	—
resolves_to	domain, subdomain	ip_address	no	—	—
reverse_resolves_to	ip_address	domain, subdomain	no	—	—
runs_technology	service, endpoint, domain, subdomain	technology	no	—	—
serves_endpoint	service	endpoint	no	—	—
supports_tls_cipher	service	tls_cipher_suite	no	—	—

Which relations a node can carry

The same matrix as above, read from the node's side.

Node	As source	As target
advisory	aliases, has_weakness	affected_by, aliases
asn	operated_by	announced_by
certificate	covers_name, has_finding, issued_by	issued_by, presents_certificate
cloud_account	has_finding	authenticates, in_account
cloud_resource	exposes_secret, has_finding, in_account	authenticates, hosted_on
cwe	—	has_weakness
dkim_record	has_finding	has_dkim_selector
dmarc_record	—	has_dmarc
domain	backed_by_bucket, caa_issue, caa_issuewild, cname_to, dname_to, federates_with, has_contact, has_dkim_selector, has_dmarc, has_finding, has_mail_exchange, has_mta_sts_policy, has_nameserver, has_registration, has_soa_primary, has_spf, has_srv_target, has_subdomain, has_svcb_binding, has_txt_record, hosted_on, owns_repository, protected_by, resolves_to, runs_technology	caa_issue, caa_issuewild, cname_to, covers_name, dname_to, has_mail_exchange, has_nameserver, has_soa_primary, has_srv_target, has_svcb_binding, reverse_resolves_to
email_address	—	authenticates, has_contact
endpoint	affected_by, backed_by_bucket, exposes_secret, has_finding, has_http_fingerprint, has_parameter, hosted_on, links_to, loads_package, protected_by, redirects_to, runs_technology	authenticates, has_contact, links_to, redirects_to, serves_endpoint
finding	affected_by, has_weakness	has_finding
host_key	—	presents_host_key
http_fingerprint	—	has_http_fingerprint
identity_tenant	has_finding	authenticates, federates_with
ip_address	has_finding, has_open_port, reverse_resolves_to	contains_ip, resolves_to
ip_cidr	announced_by, contains_cidr, contains_ip, has_finding, operated_by	contains_cidr
mta_sts_policy	has_finding	has_mta_sts_policy
organization	has_contact	operated_by
package	affected_by, exposes_secret, has_contact, has_finding, in_account, published_from	loads_package
parameter	has_finding	has_parameter
phone	—	has_contact
port	has_finding, has_service	has_open_port
registrar	has_contact	registered_through
repository	exposes_secret, has_contact, has_finding	authenticates, owns_repository, published_from
secret	authenticates, has_finding	exposes_secret
service	affected_by, has_finding, has_tls_fingerprint, presents_certificate, presents_host_key, protected_by, runs_technology, serves_endpoint, supports_tls_cipher	authenticates, has_service
spf_record	—	has_spf
storage_bucket	exposes_secret, has_finding, in_account	authenticates, backed_by_bucket
subdomain	backed_by_bucket, caa_issue, caa_issuewild, cname_to, dname_to, federates_with, has_contact, has_dkim_selector, has_dmarc, has_finding, has_mail_exchange, has_mta_sts_policy, has_nameserver, has_soa_primary, has_spf, has_srv_target, has_subdomain, has_svcb_binding, has_txt_record, hosted_on, owns_repository, protected_by, resolves_to, runs_technology	caa_issue, caa_issuewild, cname_to, covers_name, dname_to, has_mail_exchange, has_nameserver, has_soa_primary, has_srv_target, has_subdomain, has_svcb_binding, reverse_resolves_to
technology	—	protected_by, runs_technology
tls_cipher_suite	—	supports_tls_cipher
tls_fingerprint	—	has_tls_fingerprint
txt_record	—	has_txt_record
whois_registration	has_contact, has_finding, registered_through	has_registration

Checks

Each check runs after the required map has validated the properties it reads. A relation check may also read both endpoints' stored properties; it runs on the properties that will be stored, after a patch or a matching earlier edge has been merged. The version suffix changes whenever what the check accepts changes.

Check	Types	Rule
advisory_cve_scores.1	advisory	epss_score, epss_percentile and kev_added are refused unless value is a CVE id: FIRST scores and CISA lists CVEs only.
aliases_toward_cve.1	aliases	The target's id family must rank at least as high as the source's: CVE above GHSA above every OSV database id. Between equal ranks the source must be the alphabetically lower id, and two CVE ids are refused.
asn_assigned.1	asn	value 0 is rejected: AS0 is reserved and never originates routes (RFC 7607).
bucket_name_spelling.1	storage_bucket	name is checked against the declared provider: length, grammar, and the prefixes, suffixes and substrings that provider reserves.
cloud_account_spelling.1	cloud_account	account_id must be the declared provider's spelling: 12 digits for aws, a project id of 6 to 30 characters starting with a letter for gcp, a lowercase UUID subscription id for azure.
cloud_resource_hostname.1	cloud_resource	hostname must match exactly one provider-assigned default hostname pattern, and that pattern's service must be service. An alias form is refused with a pointer to the canonical one; region, when sent, must equal the region the hostname encodes and is refused on a regionless form.
contains_cidr_proper_subnet.1	contains_cidr	The target network must be a proper subnet of the source, at the same IP version.
contains_ip_member.1	contains_ip	The target address must fall inside the source network, at the same IP version.
cpe_product_level.1	technology	A cpe on a technology must leave the version attribute * or -: the node is shared by every host, so a versioned CPE belongs on the runs_technology edge beside version.
dns_name_kind.1	domain, subdomain	value must classify as this type against the bundled PSL: a registrable domain for domain, a name below one for subdomain.
has_contact_endpoint_role.1	has_contact	An endpoint target requires role iodef and method POST (RFC 6546), and iodef never targets a phone: a CAA iodef names a mailto address or an https report URL.
has_contact_registration_roles.2	has_contact	From a whois_registration, role must be registrant, admin, tech or billing; from a domain or subdomain, those four roles are refused, because they belong to one registration. From a package, role must be maintainer or security and the target an email_address; maintainer is refused from every other source.
has_registration_suffix_match.1	has_registration	The registration's registry must be the zone of its domain: the domain's value without its first label.
has_subdomain_suffix.1	has_subdomain	The target's value must end in . plus the source's value.
http_fingerprint_value_kind.1	http_fingerprint	favicon_mmh3 requires the signed 32-bit integer spelling; body_sha256 and header_sha256 require 64 lowercase hex characters.
in_account_provider_match.2	in_account	The account's provider must be the source's provider: the prefix of a cloud resource's service, the provider behind a bucket's provider, or the cloud registry host in an oci purl's repository_url: ECR (dkr.ecr.<region>.amazonaws.com(.cn) or public.ecr.aws) to aws, Artifact Registry and gcr.io to gcp, azurecr.io to azure. Any other registry and any non-oci package belong to no account.
ip_address_version.1	ip_address	version must equal the version of the address in value.
ip_cidr_version.1	ip_cidr	version must equal the version of the network in value.
port_number_assigned.1	port	number 0 is rejected: it is what a tool emits for a missing port, and no service listens there. The uint16 format keeps 0 because SRV and MX values may legitimately be 0.
registrar_iana_assigned.1	registrar	iana_id must be at least 1, because 0 is what an agent emits for a missing field.
registry_domain_id_assigned.1	whois_registration	registry_domain_id is rejected when its part before the last hyphen is all zeros or a redaction word such as REDACTED, NONE, NA, UNKNOWN, PRIVATE, WITHHELD or NOTDISCLOSED, in any case.
repository_owner_spelling.1	repository	owner is checked against the grammar and length of the declared platform, and only gitlab accepts a / for nested groups.
secret_plaintext_keys.1	secret, authenticates, exposes_secret	The record is rejected if any key at any depth, in any case, is value, secret, plaintext, password, token, key, credential, match, raw, rawv2, redacted or line, so the credential itself cannot reach storage.
service_secure_flag.1	service	A TLS-capable registry entry, such as http, additionally requires a boolean secure.
tenant_id_spelling.1	identity_tenant	entra_id requires a canonical lowercase UUID; okta requires the bare organization slug, so a dot is rejected.
tls_fingerprint_length.1	tls_fingerprint	value must be 62 characters for jarm and 32 for ja3s.
txt_record_diversion.1	txt_record	A value that the dedicated type for its version tag accepts is rejected here: v=spf1 belongs to spf_record, v=DMARC1 to dmarc_record, v=DKIM1 to dkim_record and v=STSv1 to mta_sts_policy. A malformed tagged value, such as v=spf1include:..., stays a txt_record.

Canonicalizations

Each rewrites a declared non-canonical spelling in place before validation, identity and storage.

Canonicalization	Types	Rewrite
caa_parameter_name_fold.1	caa_issue, caa_issuewild	ASCII parameter names are lowercased, because RFC 8659 tags are case-insensitive while the parameter list is identity-bearing. A non-ASCII name is left for validation to reject.
endpoint_url_drop_query.1	endpoint	Once the whole url, query included, passes http_url, everything from its first ? is removed before hashing and storage, so one path is one endpoint. A URL whose query is malformed is left unchanged and rejected.

Format rules

Every declared property that is not an enum names one of these rules. The version changes whenever what the rule accepts changes.

Rule	Version	Accepted spelling
advisory_id	1	A vulnerability id from a closed prefix list, spelled exactly as its database publishes it and never case-folded: CVE-, a 4-digit year and 4 to 19 digits; GHSA- and three --joined groups of four from 23456789cfghjmpqrvwx; or a PYSEC, RUSTSEC, GO, OSV, HSEC, JLSEC, OSEC, RSEC, EEF, DRUPAL or MAL id in the number shape that database issues. Vendor and distribution bulletins such as RHSA, DSA and USN are refused; write the CVE or GHSA they cite.
alpn_tokens	1	An array of zero or more ASCII tokens matching [A-Za-z0-9./_-]{1,255}; order is not identity-significant and duplicates are preserved.
asn	1	A strict JSON integer from 0 through 4294967295.
boolean	1	A strict JSON true or false; the strings "true" and "1" and the number 1 are rejected.
breach_token_or_empty	1	The empty string, or <corpus>:<id>: a lowercase tech_token naming the breach corpus, a colon, and 1 to 200 lowercase characters from letters, digits and ._/-, such as hibp:linkedin or leakcheck:linkedin.com. Slug a display name: lowercase, runs of other characters become one -.
bucket_name	1	The provider-global name of an object-storage bucket: 3 to 222 lowercase ASCII characters from letters, digits, hyphen, underscore and dot, starting and ending alphanumeric, without a doubled dot, and never a dotted-quad IPv4 address. Every provider is stricter than this union rule, and the declared provider fixes which of the narrower spellings is accepted.
caa_parameters	1	An array of objects with name and value strings. Names start alphanumeric and continue alphanumeric or hyphen. Values are empty or use ASCII 0x21-0x3A and 0x3C-0x7E.
calendar_date	1	A calendar date YYYY-MM-DD that exists, without a time or zone.
cidr	1	Canonical strict IPv4 or IPv6 network with an explicit prefix length.
cloud_account_id	1	1 to 64 lowercase ASCII letters, digits and hyphens, starting and ending alphanumeric. The declared provider fixes the spelling: 12 digits for AWS, a project id for GCP, a lowercase UUID for Azure.
cloud_region	1	1 to 32 lowercase ASCII letters, digits and hyphens, starting and ending alphanumeric.
cpe23	1	A lowercase CPE 2.3 formatted string (NIST IR 7695) of at most 512 characters: 'cpe:2.3:', the part, and ten colon-separated attributes, each '', '-', or an escaped value optionally anchored by '' or a run of '?'. The legacy 'cpe:/' URI binding that nmap prints is rejected; convert it.
credential_key_id	1	1 to 128 characters from ASCII letters, digits and ._:/+=-: the public identifier half of a two-part credential, such as an AWS access key id, never secret material.
cvss_score	1	A strict JSON number from 0 through 10 with at most one decimal place, as CVSS publishes a score: 9.8 and 10 are accepted, 9.85 and "9.8" are not.
cvss_vector	1	A CVSS vector string with its version prefix, CVSS:3.0/, CVSS:3.1/ or CVSS:4.0/, then /-separated METRIC:value pairs, each metric once and every base metric of that version present. The unprefixed CVSS 2 form is rejected.
cwe	1	A string matching CWE-[0-9]{1,6} exactly, uppercase as MITRE publishes it.
dkim_selector	1	A lowercase ASCII DKIM selector of at most 253 bytes, as one or more dot-separated labels of at most 63 bytes each, written without the _domainkey suffix or the domain. In practice it is far shorter, since <selector>._domainkey.<domain> must itself fit in 253 bytes.
dmarc	1	Printable ASCII of at most 4096 characters beginning with 'v=DMARC1' followed by a semicolon, a normal space, or end of text.
dns_name	1	A lowercase ASCII domain or subdomain spelling classified by the bundled ICANN PSL; at least two labels, labels at most 63 bytes, total at most 253 bytes, and no trailing dot.
dns_or_explicit_empty	1	dns_name or the explicit empty string for no SNI offer; IP literals are rejected.
email_address	1	A lowercase ASCII mailbox of at most 254 characters: an RFC 5322 dot-atom local part of at most 64 characters, one @, and a domain that satisfies dns_name. Quoted local parts, address literals and display names are rejected. A local part is case-sensitive on the wire; this rule requires the lowercase spelling anyway, so one mailbox is one node.
epp_status_list	1	A non-empty array of EPP domain status codes in their camelCase spelling, from RFC 5731 and the RFC 3915 grace periods, sorted ascending with no duplicate. Convert RDAP's spaced words: client transfer prohibited is clientTransferProhibited, active is ok.
finding_matcher_or_empty	1	The empty string, or 1 to 400 characters from ASCII letters, digits and ._:/-: the reporting tool's sub-rule discriminator, such as a nuclei matcher name or <host>:<matcher> for a TLS result.
finding_rule	1	<tool>:<id>: a lowercase tech_token naming the reporting tool, a colon, and 1 to 200 characters from ASCII letters, digits and ._/- spelling the tool's own rule id, such as nuclei:http-missing-security-headers or manual:exposed-admin-panel.
git_ref_name	1	A branch name as git check-ref-format --branch accepts it, one level allowed: at most 255 ASCII characters, no space, control character or any of ~^:?*[\, no .., @{ or //, no component starting with . or ending .lock, and not @, HEAD or a leading -.
hex_serial	1	A certificate serial number as 1 to 40 lowercase hexadecimal digits without leading zeros or separators: tlsx's AB:CD:... becomes abcd....
html_token	1	An HTML element or attribute name: a lowercase letter, then up to 31 letters, digits or hyphens.
html_token_or_empty	1	The empty string, or an html_token.
http_fingerprint_value	1	Either a signed 32-bit decimal integer written in ASCII without a leading zero or a plus sign, for a MurmurHash3 favicon hash, or exactly 64 lowercase hexadecimal characters for a response digest. The declared kind fixes which one is accepted.
http_status	1	A strict JSON integer HTTP status code from 100 through 599.
http_url	1	Canonical absolute ASCII http/https URL with a lowercase host (underscore labels are accepted left of the registrable domain, as for subdomain), mandatory path, no userinfo, fragment, whitespace, backslash, Unicode, default explicit port, dot path segment, or lowercase percent escape. A submitted query string is validated with the rest of the URL and then removed before identity and storage, so one endpoint holds one path; parameter names belong to parameter nodes.
ip	1	Canonical IPv4Address.compressed or lowercase IPv6Address.compressed spelling, without scope or prefix. An IPv4-mapped IPv6 address (::ffff:192.0.2.1) is rejected: write the IPv4 address.
ip_version	1	A strict JSON integer equal to 4 or 6.
iso3166_alpha2	1	Two uppercase ASCII letters in the ISO 3166-1 alpha-2 shape, as registries publish a country: US, DE. Shape only; membership in the ISO list is not checked.
media_type	1	A lowercase media type essence type/subtype of RFC 6838 restricted names, without parameters: text/html, never text/html; charset=utf-8 or Text/HTML.
method	1	One to 32 characters matching an uppercase HTTP method token.
mta_sts	1	Printable ASCII of at most 4096 characters beginning with 'v=STSv1' followed by a semicolon, a normal space, or end of text: the TXT record at _mta-sts.<domain>, not the policy file body.
multiline_text_4096	1	1 to 4096 printable Unicode characters, newlines and tabs included.
mx_pattern_list	1	An array of RFC 8461 mx patterns, each a lowercase dns_name or *. followed by one, sorted ascending with no duplicate, so one policy has one spelling.
package_purl	1	A versionless purl of at most 512 characters, pkg:<type>/<namespace>/<name> for npm, pypi, maven, nuget, gem, cargo, golang, composer or oci, canonical, not rewritten: npm name as published, scope %40acme; PyPA-normalized PyPI name; lowercase NuGet id, crate (_ not -); namespaced maven, composer, golang. No version, subpath or qualifier but oci's required repository_url: unencoded host[:port]/path ending in the name; Docker Hub as docker.io, official images in library/; ECR as <account>.dkr.ecr.<region>.amazonaws.com(.cn), no FIPS/dual-stack alias. Write docker as oci.
parameter_name	1	1 to 128 printable ASCII characters without space, &, =, or #; one single parameter name, never a raw query string.
partial_date	1	YYYY, YYYY-MM or YYYY-MM-DD, a date known only to the precision the source gives.
phone_e164	1	An E.164 number: +, a leading digit from 1 through 9, and in total 2 to 15 digits.
printable_text_1024	1	A string of 1-1024 printable Unicode characters.
printable_text_200	1	A string of 1-200 printable Unicode characters.
probability	1	A strict JSON number from 0 through 1, such as an EPSS score or percentile.
public_suffix	1	A lowercase ASCII zone under which names are registered, per the bundled ICANN PSL: one more label makes a registrable domain, so com and co.uk qualify and example.com does not.
redirect_status	1	A strict JSON integer in 301, 302, 303, 307, or 308.
registry_domain_id	1	An RFC 5730 repository object id in ASCII, as the registry publishes it in the RDAP handle or the WHOIS Registry Domain ID: 1-80 letters, digits or underscores, a hyphen, and a 1-8 character alphanumeric repository suffix, such as 2138514_DOMAIN_COM-VRSN. Case is preserved.
repo_name	1	A 1-100 character lowercase ASCII repository name from letters, digits, dot, underscore and hyphen, holding at least one alphanumeric character and never the reserved . or ... Hosting platforms resolve names case-insensitively, so the lowercase spelling keeps one repository one node.
repo_owner	1	A 1-255 character lowercase ASCII owner path of one or more /-separated segments, each 1-100 characters from letters, digits, dot, underscore and hyphen and each starting and ending alphanumeric. The separator exists for nested GitLab groups; the declared platform fixes whether more than one segment is accepted.
rir_handle	1	A regional-registry object handle of 2 to 64 ASCII characters, starting and ending alphanumeric and continuing alphanumeric or hyphen. Handles are case-sensitive and stored exactly as the registry publishes them: RIPE and AFRINIC preserve the organisation name's case (ORG-nG51-RIPE), so never uppercase one. Handles are unique within one registry, never across registries.
service_name	1	A member of the bundled versioned service name whitelist.
sha256	1	Exactly 64 lowercase ASCII hexadecimal characters.
spf	1	Printable ASCII of at most 4096 characters beginning with v=spf1 followed by a normal space or end of text, the same bound as every other TXT value rule.
srv_label	1	A 2-63 byte lowercase ASCII SRV label beginning with underscore.
tag_list	1	A non-empty array of tech_token tags, lowercase, sorted ascending with no duplicate, so one tag set has one spelling.
tech_token	1	A 1-63 character lowercase ASCII technology slug that starts and ends alphanumeric and may contain interior dot, underscore, plus, or hyphen.
tech_version	1	1 to 64 printable ASCII characters without space: a version string as the product reports it.
tenant_id	1	A 1-128 character lowercase ASCII identity-tenant identifier that starts and ends alphanumeric and may contain interior dot, underscore or hyphen. The declared provider fixes the narrower spelling: a canonical lowercase UUID for Entra ID, a bare organization slug for Okta.
tls_cipher_name	1	The spelling of an IANA TLS cipher suite name: 5 to 128 uppercase ASCII characters beginning 'TLS_', with underscore-separated alphanumeric components. Shape only; membership in the IANA registry is not checked.
tls_fingerprint_value	1	Exactly 32 lowercase hexadecimal characters for a JA3S MD5 digest, or exactly 62 for a JARM fingerprint. The declared kind fixes which length is accepted.
txt_value	1	1 to 4096 printable ASCII characters, the concatenated and unquoted character-strings of one TXT RRset.
uint16	1	A strict JSON integer from 0 through 65535.
uint32	1	A strict JSON integer from 0 through 4294967295.
uint63	1	A strict JSON integer from 0 through 9223372036854775807.
uint8	1	A strict JSON integer from 0 through 255.
username_or_empty	1	The empty string, or 1 to 256 printable ASCII characters without space: a login name exactly as the source spells it.
utc_timestamp	1	An instant in UTC as YYYY-MM-DDTHH:MM:SSZ with an optional 1-6 digit fraction before the Z. Offsets are rejected, so one instant has one spelling and stored values sort and compare as text.

Node type details

advisory

One published vulnerability record, identified by its CVE, GHSA or OSV ecosystem id and shared by every object it affects.

Not modeled: Not an observation that something is vulnerable; that is affected_by from the affected object. Not a vendor or distribution bulletin such as RHSA, DSA or USN, and not the affected products, version ranges, references or description, which stay in evidence. Never a finding source.

When the vulnerability has a known CVE, write the CVE id, even if a GHSA or OSV record is where it was found, so one vulnerability is one node. When a non-CVE advisory you wrote turns out to have a CVE, write the CVE advisory and link the two with aliases.

Identity: value
Parent scope: —
Inventory: none
Checks: advisory_cve_scores.1
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	advisory_id	The advisory id, spelled exactly as its database publishes it.
cvss_score	no	cvss_score	The CVSS base score the advisory publishes, from its highest CVSS version.
cvss_vector	no	cvss_vector	The CVSS vector string that score comes from.
epss_percentile	no	probability	The EPSS score's percentile among all scored CVEs; CVE ids only.
epss_score	no	probability	The FIRST EPSS probability of exploitation in the next 30 days; CVE ids only.
kev_added	no	calendar_date	The date CISA added the CVE to its Known Exploited Vulnerabilities catalog; CVE ids only.
published	no	utc_timestamp	When the advisory record was published.

asn

An autonomous system number: the routing identity a network is announced from.

Not modeled: Not the organization holding it (organization through operated_by) and not the prefixes it announces (ip_cidr through announced_by).

Identity: value
Parent scope: —
Inventory: carries
Checks: asn_assigned.1
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	asn	The AS number as an integer, without the AS prefix.
country	no	iso3166_alpha2	The country the registry records for the AS.
name	no	printable_text_200	The holder's AS name as the registry or routing data publishes it; the latest write wins.
rir	no	one of arin, ripe, apnic, lacnic, afrinic	The regional registry that assigned the AS.

certificate

One X.509 certificate, identified by the SHA-256 of its DER encoding.

Not modeled: Not the handshake that presented it (presents_certificate from a service) and not the names it covers, which are covers_name edges.

A self edge through issued_by records a self-signed certificate. Absence of that edge means the issuer was never written, not that the chain ends.

Identity: der_sha256
Parent scope: —
Inventory: carries
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
der_sha256	yes	sha256	Lowercase hex SHA-256 of the certificate's DER bytes.
issuer_dn	no	printable_text_1024	The issuer distinguished name as the scanner prints it.
not_after	no	utc_timestamp	The end of the validity period.
not_before	no	utc_timestamp	The start of the validity period.
self_signed	no	boolean	True when the subject signed itself; keep it beside the issued_by self edge.
serial	no	hex_serial	The serial number in lowercase hex without separators or leading zeros.
subject_cn	no	printable_text_1024	The subject common name.

cloud_account

A provider tenancy container: an AWS account, a GCP project or an Azure subscription.

Not modeled: Not an identity-provider tenant (identity_tenant), a user or a billing profile.

Identity: provider, account_id
Parent scope: —
Inventory: carries
Checks: cloud_account_spelling.1
Canonicalizations: —

Property	Required	Rule	Meaning
account_id	yes	cloud_account_id	The provider's id: AWS account id, GCP project id or Azure subscription id.
provider	yes	one of aws, gcp, azure	The cloud provider.

cloud_resource

A provider-managed resource that answers at a provider-assigned default hostname, such as a CloudFront distribution, an App Service app or a Firebase site, keyed on that hostname.

Not modeled: Not the DNS name as such (subdomain), not object storage (storage_bucket) and not a path-addressed resource such as a Cloud Function, which is an endpoint.

Each accepted hostname names one resource at a time, so a takeover keeps the node and moves its in_account edge. Write a custom name or an alias host (dualstack., .scm., .firebaseapp.com, -dot- routes) as a subdomain reached through hosted_on. Cloud Run and project-level Cloud Functions hosts have no one-resource default hostname and are not modeled.

Identity: hostname
Parent scope: —
Inventory: carries
Checks: cloud_resource_hostname.1
Canonicalizations: —

Property	Required	Rule	Meaning
hostname	yes	dns_name	The canonical provider-assigned default hostname.
service	yes	one of aws_cloudfront, aws_api_gateway, aws_lambda_url, aws_elastic_beanstalk, aws_elb, azure_app_service, azure_cloud_service, azure_public_ip, azure_traffic_manager, azure_front_door, azure_api_management, gcp_app_engine, gcp_firebase_hosting, gcp_firebase_rtdb	The provider service, fixed by which default hostname pattern matches.
region	no	cloud_region	The region the hostname encodes, when it encodes one.

cwe

A CWE weakness class: the canonical spelling that joins findings from different scanners.

Not modeled: Not a finding or an advisory; those reach it through has_weakness. Never a finding source.

Identity: value
Parent scope: —
Inventory: none
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	cwe	The CWE id as MITRE publishes it, such as CWE-79.
name	no	printable_text_200	MITRE's name for the weakness class, fed by the CWE catalog rather than a scanner.

dkim_record

The DKIM key record one domain publishes for one selector, scoped through has_dkim_selector.

Not modeled: Not the <selector>._domainkey owner name as a subdomain node.

Writing the same selector again patches value in place, so the node is a current-state view; a rotated key survives only in evidence attached to the earlier write.

Identity: selector
Parent scope: has_dkim_selector (source)
Inventory: inherits
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
selector	yes	dkim_selector	The selector labels, without ._domainkey or the domain.
value	yes	txt_value	The normalized TXT value: unquoted, unescaped, with multi-string RRsets concatenated.

dmarc_record

A DMARC policy value, shared by every name that publishes the same string.

Not modeled: Not the _dmarc owner name; has_dmarc attaches the record to the domain or subdomain itself.

Identity: value
Parent scope: —
Inventory: none
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	dmarc	The normalized TXT value beginning v=DMARC1.

domain

A registrable domain name as the bundled public suffix list classifies it, such as example.co.uk.

Not modeled: Not a name below a registrable domain (subdomain) and not a public suffix. Registration dates, status and DNSSEC state belong to a whois_registration, not to the name.

Identity: value
Parent scope: —
Inventory: carries
Checks: dns_name_kind.1
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	dns_name	The lowercase ASCII name without a trailing dot; IDNs in punycode.
wildcard	no	boolean	True when random labels directly under this name resolve, a DNS wildcard.

email_address

A mailbox, reached as a contact through has_contact.

Not modeled: Not a person; person and company types are out of scope. Never a finding source.

Identity: value
Parent scope: —
Inventory: carries
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	email_address	The mailbox, lowercase including the local part.

endpoint

One HTTP method on one URL path: the unit a crawler or scanner observes.

Not modeled: Not a query string or its values (parameter names are parameter nodes) and not the host or service that serves it.

Response digests are pivots on http_fingerprint nodes, not endpoint attributes. Raw response bodies and headers belong in evidence, where they are full-text indexed. Only the query is removed from url: a secret carried in the path, such as a webhook token, stays in it.

Identity: url, method
Parent scope: —
Inventory: carries
Checks: —
Canonicalizations: endpoint_url_drop_query.1

Property	Required	Rule	Meaning
method	yes	method	The uppercase HTTP method token.
url	yes	http_url	Absolute canonical http/https URL; a valid submitted query string is removed before identity.
content_length	no	uint63	The body length in bytes of the latest response.
content_type	no	media_type	The media type essence of the latest response, without parameters.
status	no	http_status	The status code of the latest response observed.
title	no	printable_text_1024	The HTML title of the latest response.
webserver	no	printable_text_200	The Server header value of the latest response.

finding

One issue a scanner or analyst reports about one object, scoped to it through has_finding.

Not modeled: Not the weakness class (cwe) or a published advisory (advisory); those link through has_weakness and affected_by.

Identity is the rule and matcher under the parent, as nuclei deduplicates by template, matcher and target, so a renamed template patches title instead of forking. Send a distinct matcher for each result one rule reports on one parent; two results sharing "" overwrite each other. unknown severity means none was assigned and is not ordinal: never sort or filter it as below info.

Identity: rule, matcher
Parent scope: has_finding (source)
Inventory: inherits
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
matcher	yes	finding_matcher_or_empty	The sub-rule discriminator, such as a matcher name, or empty when the rule has one result.
rule	yes	finding_rule	The reporting tool and its rule id, such as a nuclei template id.
severity	yes	one of info, low, medium, high, critical, unknown	The reporter's severity; the latest write wins.
title	yes	printable_text_200	The rule's human-readable name; the latest write wins.
confidence	no	one of unknown, low, medium, high, confirmed	How sure the reporter is, in BBOT's scale.
cvss_score	no	cvss_score	The CVSS score the reporter assigns.
cvss_vector	no	cvss_vector	The CVSS vector the reporter assigns.
description	no	multiline_text_4096	The reporter's description, never one that embeds a secret.
scanner	no	tech_token	The tool that reported it, when rule names a wrapped tool.
tags	no	tag_list	The rule's tags, lowercase, sorted.

host_key

An SSH host public key, shared by every service that presents it.

Not modeled: Not a host. Two hosts presenting one key are a cloned image or one machine at two addresses, which makes this a correlation pivot. Never a finding source.

Identity: algorithm, fingerprint_sha256
Parent scope: —
Inventory: carries
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
algorithm	yes	one of ssh-rsa, ssh-dss, ssh-ed25519, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com	The SSH public key algorithm name.
fingerprint_sha256	yes	sha256	Lowercase hex SHA-256 of the raw public key blob, converted from OpenSSH's base64 SHA256: form.

http_fingerprint

A response-side clustering pivot: a favicon hash or a body or header digest.

Not modeled: Not an identifier of a host or an owner; a shared default favicon or framework page is common. Never a finding source.

Identity: kind, value
Parent scope: —
Inventory: none
Checks: http_fingerprint_value_kind.1
Canonicalizations: —

Property	Required	Rule	Meaning
kind	yes	one of favicon_mmh3, body_sha256, header_sha256	Which fingerprint value holds.
value	yes	http_fingerprint_value	Decimal signed 32-bit MurmurHash3 for favicon_mmh3, lowercase hex SHA-256 otherwise.

identity_tenant

An identity-provider tenant, such as an Entra ID directory or an Okta organization.

Not modeled: Not a cloud billing account or subscription and not a user.

Identity: provider, tenant_id
Parent scope: —
Inventory: carries
Checks: tenant_id_spelling.1
Canonicalizations: —

Property	Required	Rule	Meaning
provider	yes	one of entra_id, okta	The identity provider; each member fixes one canonical tenant_id spelling.
tenant_id	yes	tenant_id	The tenant identifier in the provider's canonical spelling.

ip_address

One IPv4 or IPv6 address.

Not modeled: Not a network (ip_cidr) and not a name that resolves to it (resolves_to).

A range-list classification (cdncheck, httpx cdn_name) is an attribute of the address; a CDN or WAF seen in front of a name or service is a protected_by edge instead.

Identity: value
Parent scope: —
Inventory: carries
Checks: ip_address_version.1
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	ip	The canonical compressed address spelling.
version	yes	ip_version	4 or 6, matching value.
cdn_provider	no	tech_token	The CDN whose published ranges hold the address, such as cloudflare.
cloud_provider	no	tech_token	The cloud provider whose published ranges hold the address, such as aws.
waf_provider	no	tech_token	The WAF vendor whose published ranges hold the address.

ip_cidr

One IPv4 or IPv6 network with an explicit prefix length, as allocated, announced or scanned.

Not modeled: Not a single address (ip_address) and not its holder (organization through operated_by).

Identity: value
Parent scope: —
Inventory: carries
Checks: ip_cidr_version.1
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	cidr	The canonical network spelling, host bits zero.
version	yes	ip_version	4 or 6, matching value.
country	no	iso3166_alpha2	The country the registry records for the network.
netname	no	printable_text_200	The registry network name (RDAP name, WHOIS netname).
rir	no	one of arin, ripe, apnic, lacnic, afrinic	The regional registry that allocated the network.

mta_sts_policy

The MTA-STS TXT record a name publishes at _mta-sts.<name>, scoped through has_mta_sts_policy.

Not modeled: Not the policy file body served over HTTPS; its fields are attributes of this node.

Scoped because the TXT value is only a version pointer that unrelated tenants publish verbatim; unscoped, their policy attributes would overwrite each other.

Identity: value
Parent scope: has_mta_sts_policy (source)
Inventory: inherits
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	mta_sts	The TXT value beginning v=STSv1.
max_age	no	uint32	The policy file's max_age, in seconds.
mode	no	one of enforce, testing, none	The policy file's mode.
mx	no	mx_pattern_list	The policy file's mx patterns, sorted and without duplicates.

organization

A number-resource holder known to a regional internet registry, keyed on the registry and handle.

Not modeled: Not a company in general and not a domain registrant; person and company types are out of scope.

Identity: registry, handle
Parent scope: —
Inventory: carries
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
handle	yes	rir_handle	The RIR object handle, case preserved exactly as the registry publishes it.
registry	yes	one of arin, ripe, apnic, lacnic, afrinic	The RIR that issued the handle.
name	no	printable_text_200	The organization's name as the registry publishes it; free text, so never identity.

package

A package or container image the target publishes to a registry, keyed on its versionless purl, so every release of it is one node. An image keeps the registry repository it lives in.

Not modeled: Not a component the target runs or depends on: that is a technology reached through runs_technology, so a package is never a dependency. Not a release: versions, tags and digests stay in evidence and in a finding's matcher.

Write a package whose publisher is not yet attributed to the target as a candidate, and reject it with evidence once it proves to be someone else's. Which releases contain a secret or a vulnerability is recorded in evidence, never as a property or a node per version. A Go module path is written lowercased, as the purl spec requires: github.com/Azure/azure-sdk-for-go is pkg:golang/github.com/azure/azure-sdk-for-go. An oci registry host never carries the default port 443: docker.io:443 is written docker.io. An internal registry may be a dotted IPv4 address; localhost is refused.

Identity: purl
Parent scope: —
Inventory: carries
Allowed ownership: owned, candidate, rejected
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
purl	yes	package_purl	The versionless purl in its canonical spelling; an oci purl keeps only repository_url.

parameter

One named input of one endpoint, by name and location, scoped through has_parameter.

Not modeled: Not a value seen for the parameter; values are sample data for evidence.

Identity: name, location
Parent scope: has_parameter (source)
Inventory: inherits
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
location	yes	one of query, body, header, cookie, path	Where the parameter travels in the request.
name	yes	parameter_name	One parameter name, never a raw query string.

phone

A telephone contact, reached through has_contact.

Not modeled: Not a person or a subscriber. Never a finding source.

Identity: value
Parent scope: —
Inventory: carries
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	phone_e164	The E.164 number with its leading plus.

port

One open transport port on one address, scoped to its ip_address through has_open_port.

Not modeled: Not a closed or filtered port: only open ports are written, and the scope edge is the state.

Identity: transport, number
Parent scope: has_open_port (source)
Inventory: inherits
Checks: port_number_assigned.1
Canonicalizations: —

Property	Required	Rule	Meaning
number	yes	uint16	The port number.
transport	yes	one of tcp, udp, sctp	The transport protocol.

registrar

An ICANN-accredited registrar, keyed on its IANA registrar id.

Not modeled: Not a registry or a reseller. A registrar without an IANA id gets no node.

Identity: iana_id
Parent scope: —
Inventory: none
Checks: registrar_iana_assigned.1
Canonicalizations: —

Property	Required	Rule	Meaning
iana_id	yes	uint16	The IANA registrar id.
name	yes	printable_text_200	The registrar's name; the latest write wins, because names change with renames and mergers.

repository

A source-code repository on one hosting instance, keyed on the host, owner and name.

Not modeled: Not an organization or a person. owns_repository attributes it to a name and needs evidence.

Identity: host, owner, name
Parent scope: —
Inventory: carries
Checks: repository_owner_spelling.1
Canonicalizations: —

Property	Required	Rule	Meaning
host	yes	dns_name	The hosting instance's host name.
name	yes	repo_name	The repository name, lowercase.
owner	yes	repo_owner	The owner path, lowercase; only gitlab nests groups.
platform	yes	one of github, gitlab, bitbucket, gitea	The hosting software, which selects the owner grammar; not identity.
archived	no	boolean	Whether the repository is archived.
default_branch	no	git_ref_name	The default branch name.
fork	no	boolean	Whether the repository is a fork.
visibility	no	one of public, private, internal	The platform's visibility setting.

secret

One exposed credential, identified only by the SHA-256 of the secret so its occurrences join.

Not modeled: Never the secret itself: a node carrying a plaintext-bearing key is rejected.

Hash the secret part's UTF-8 bytes untrimmed: trufflehog Raw or the secret half of a two-part RawV2, gitleaks Secret (never Match), a leak corpus password or its published hash; in PEM, CRLF becomes LF. Compute it, then replace every secret field with [REDACTED] before ingesting the output as evidence. A password digest is unsalted and reversible by dictionary: treat the workspace as holding the passwords. Always send kind.

Identity: value_sha256
Parent scope: —
Inventory: carries
Checks: secret_plaintext_keys.1
Canonicalizations: —

Property	Required	Rule	Meaning
value_sha256	yes	sha256	Lowercase hex SHA-256 of the exact secret bytes.
detector	no	tech_token	The scanner rule that found it, such as trufflehog's aws; not identity.
key_id	no	credential_key_id	The public identifier half of a two-part credential, such as an AWS access key id.
kind	no	one of password, password_hash, api_key, access_token, private_key, session_token, connection_string, webhook_url, other	What the secret is; send it whenever the source says, and other only when it cannot.
verified	no	boolean	Whether the scanner confirmed the credential works; the latest write wins.

service

The application protocol a port speaks, scoped to that port through has_service.

Not modeled: Not the product or version implementing it; that is runs_technology.

Identity: name
Parent scope: has_service (source)
Inventory: inherits
Checks: service_secure_flag.1
Canonicalizations: —

Property	Required	Rule	Meaning
name	yes	service_name	A member of the bundled Nmap-derived service-name registry.
product	no	printable_text_200	The product a version probe names, such as OpenSSH.
secure	no	boolean	Whether the service runs over TLS; required for a TLS-capable name such as http.
version	no	tech_version	The version a version probe reports.

spf_record

An SPF policy value, shared by every name that publishes the same string.

Not modeled: Not the publishing name (has_spf) and not a malformed SPF-like value, which is a txt_record.

Identity: value
Parent scope: —
Inventory: none
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	spf	The normalized TXT value beginning v=spf1.

storage_bucket

An object-storage bucket in a provider-global namespace.

Not modeled: Not an Azure container (the node is the storage account) and not a regional namespace such as DigitalOcean Spaces.

Identity: provider, name
Parent scope: —
Inventory: carries
Checks: bucket_name_spelling.1
Canonicalizations: —

Property	Required	Rule	Meaning
name	yes	bucket_name	The provider-global bucket name, or the Azure storage account name.
provider	yes	one of aws_s3, gcp_gcs, azure_blob	The storage provider, whose naming rules the name must satisfy.

subdomain

A DNS name below a registrable domain, such as api.example.com.

Not modeled: Not the registrable domain itself (domain).

Identity: value
Parent scope: —
Inventory: carries
Checks: dns_name_kind.1
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	dns_name	The lowercase ASCII name without a trailing dot; IDNs in punycode.
wildcard	no	boolean	True when random labels directly under this name resolve, a DNS wildcard.
wildcard_answer	no	boolean	True when this name's answer equals its parent wildcard's, so it may not exist.

technology

A product, framework or service slug, shared by every host that runs it.

Not modeled: Not a per-host version, which belongs on runs_technology. Never a finding source.

The slug has no naming authority; use the product's Wappalyzer name lowercased with spaces as hyphens, and put the vendor's product-level CPE in cpe to anchor it.

Identity: name
Parent scope: —
Inventory: none
Checks: cpe_product_level.1
Canonicalizations: —

Property	Required	Rule	Meaning
name	yes	tech_token	The lowercase product slug.
cpe	no	cpe23	The product-level CPE 2.3 name, with the version attribute * or -.

tls_cipher_suite

An IANA TLS cipher suite at one protocol version, shared by every service accepting it.

Not modeled: Not a negotiated session. Never a finding source.

Identity: version, name
Parent scope: —
Inventory: none
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
name	yes	tls_cipher_name	The IANA cipher suite name.
version	yes	one of ssl30, tls10, tls11, tls12, tls13, dtls10, dtls12, dtls13	The protocol version the suite was offered at.

tls_fingerprint

A TLS stack clustering pivot, JARM or JA3S, shared by every host behind one stack.

Not modeled: Not a host identifier: every host behind one load balancer presents the same JARM.

Identity: kind, value
Parent scope: —
Inventory: none
Checks: tls_fingerprint_length.1
Canonicalizations: —

Property	Required	Rule	Meaning
kind	yes	one of jarm, ja3s	Which fingerprint value holds.
value	yes	tls_fingerprint_value	The fingerprint: 62 characters for JARM, 32 for JA3S.

txt_record

A generic TXT value a name publishes, when no dedicated type accepts it.

Not modeled: Not an SPF, DMARC, DKIM or MTA-STS value its dedicated type accepts, and never an ephemeral _acme-challenge value.

Identity: value
Parent scope: —
Inventory: none
Checks: txt_record_diversion.1
Canonicalizations: —

Property	Required	Rule	Meaning
value	yes	txt_value	The normalized TXT value.

whois_registration

One registry-level registration of a registrable domain, known by the repository object id the registry assigns (RDAP handle, WHOIS Registry Domain ID) and scoped through has_registration.

Not modeled: Not the domain name, which outlives registrations; not the registrant, since person and company types are out of scope; and not a WHOIS or RDAP response, which is evidence.

A drop and re-registration gets a new object id, so a new node, and the old one keeps its dates. When the registry publishes no id, or only a redaction placeholder, write no registration: keep the response as evidence on the domain and never invent a key.

Identity: registry, registry_domain_id
Parent scope: has_registration (source)
Inventory: inherits
Checks: registry_domain_id_assigned.1
Canonicalizations: —

Property	Required	Rule	Meaning
registry	yes	public_suffix	The zone the name is registered in, such as com or co.uk: the domain without its first label.
registry_domain_id	yes	registry_domain_id	The registry's repository object id for this registration, exactly as published.
dnssec_signed	no	boolean	Whether the registry holds DS records for the name (RDAP delegationSigned).
epp_status	no	epp_status_list	The EPP status codes the registry reports, sorted.
registration_created	no	utc_timestamp	When the registration was created (RDAP registration event).
registration_expires	no	utc_timestamp	When it expires unless renewed (RDAP expiration event).
registration_updated	no	utc_timestamp	When the registry last changed it (RDAP last changed event).
whois_server	no	dns_name	The registry's port-43 WHOIS server, never the registrar's.

Relation type details

affected_by

The source is affected by the advisory: a vulnerable service, an endpoint a CVE template matched, a finding reporting it, or a published package with an affected release.

Not modeled: Not an advisory merely mentioned nearby; attach the evidence for the match.

When the vulnerability has a known CVE, write the CVE id as the target, even if a GHSA or OSV record is where it was found. An edge written before the CVE was known stays; link its advisory to the CVE with aliases rather than rewriting the edge.

Identity: —
Sources: service, finding, endpoint, package
Targets: advisory
Self edge: no
Checks: —
Canonicalizations: —

aliases

The two advisories name the same vulnerability, and the target is the id a pivot starts from.

Not modeled: Not a related or similar vulnerability, and not a bulletin that bundles CVEs. Never between two CVE ids, and never an advisory to itself.

One edge per pair, pointing toward the CVE: write the CVE id as the target, a GHSA as the target of an OSV database id, and between equal ranks the alphabetically higher id. An OSV record that aliases two CVEs links to each, so one id per vulnerability is a convention, not a guarantee.

Identity: —
Sources: advisory
Targets: advisory
Self edge: no
Checks: aliases_toward_cve.1
Canonicalizations: —

announced_by

The network is announced in BGP by the AS.

Not modeled: Not the holder of the network; that is operated_by.

Identity: —
Sources: ip_cidr
Targets: asn
Self edge: no
Checks: —
Canonicalizations: —

authenticates

The secret is a credential for the principal: a mailbox, account, tenant, repository, service, endpoint, bucket or cloud resource, optionally for one login name and one breach.

Not modeled: Not a person. Never the secret itself: plaintext-bearing keys are refused, and the secret node holds only its digest.

Identity is (username, breach), so one pair exposed in two breaches is two edges. The breach token joins spellings within one corpus only; across corpora the same breach stays two tokens. Send "" for a value the source does not give, never a guess. Link evidence only after replacing every secret-bearing field with [REDACTED].

Identity: username, breach
Sources: secret
Targets: email_address, cloud_account, identity_tenant, repository, service, endpoint, storage_bucket, cloud_resource
Self edge: no
Checks: secret_plaintext_keys.1
Canonicalizations: —

Property	Required	Rule	Meaning
breach	yes	breach_token_or_empty	The corpus and breach id the pair was published in, or empty for a live scanner hit.
username	yes	username_or_empty	The login name the credential is for, as the source spells it, or empty.
breach_date	no	partial_date	When the breach happened, to the precision the corpus gives.
breach_title	no	printable_text_200	The corpus's display name for the breach; the latest write wins.
verified	no	boolean	Whether the pair was confirmed to work.

backed_by_bucket

A name or URL serves content from the bucket.

Not modeled: Not a bucket found only by guessing names; write that bucket node with its evidence instead.

Identity: —
Sources: domain, subdomain, endpoint
Targets: storage_bucket
Self edge: no
Checks: —
Canonicalizations: —

caa_issue

A CAA issue property at the source name authorizes the issuer domain named by the target.

Not modeled: Not a wildcard authorization (caa_issuewild) and not an iodef reporting address.

Identity: flags, parameters, with parameters hashed order-independently
Sources: domain, subdomain
Targets: domain, subdomain
Self edge: yes
Checks: —
Canonicalizations: caa_parameter_name_fold.1

Property	Required	Rule	Meaning
flags	yes	uint8	The CAA flags octet.
parameters	yes	caa_parameters	The property's parameters; names are lowercased and the list is hashed order-independently.

caa_issuewild

A CAA issuewild property at the source name authorizes the target issuer for wildcard names.

Not modeled: Not a non-wildcard authorization (caa_issue).

Identity: flags, parameters, with parameters hashed order-independently
Sources: domain, subdomain
Targets: domain, subdomain
Self edge: yes
Checks: —
Canonicalizations: caa_parameter_name_fold.1

Property	Required	Rule	Meaning
flags	yes	uint8	The CAA flags octet.
parameters	yes	caa_parameters	The property's parameters; names are lowercased and the list is hashed order-independently.

cname_to

A CNAME record at the source name points to the target name.

Not modeled: Not resolution to an address (resolves_to) and not a subtree redirect (dname_to).

Identity: —
Sources: domain, subdomain
Targets: domain, subdomain
Self edge: yes
Checks: —
Canonicalizations: —

contains_cidr

The source network properly contains the target network.

Not modeled: Not an allocation or announcement fact; containment is arithmetic, checked on write.

Identity: —
Sources: ip_cidr
Targets: ip_cidr
Self edge: no
Checks: contains_cidr_proper_subnet.1
Canonicalizations: —

contains_ip

The source network contains the target address.

Not modeled: Not a claim that the address is in use; containment is arithmetic, checked on write.

Identity: —
Sources: ip_cidr
Targets: ip_address
Self edge: no
Checks: contains_ip_member.1
Canonicalizations: —

covers_name

The certificate covers the target name, literally or through a wildcard SAN.

Not modeled: Not a name the certificate was merely presented for; that is presents_certificate.

Identity: coverage
Sources: certificate
Targets: domain, subdomain
Self edge: no
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
coverage	yes	one of exact, wildcard	exact for a literal SAN, wildcard when a *. SAN covers the target base name.

dname_to

A DNAME record at the source name redirects its whole subtree to the target.

Not modeled: Not a single-name alias (cname_to).

Identity: —
Sources: domain, subdomain
Targets: domain, subdomain
Self edge: yes
Checks: —
Canonicalizations: —

exposes_secret

The source exposes the secret at one location.

Not modeled: Never the secret itself; the node holds only its digest, and plaintext-bearing keys are refused.

Link evidence only after replacing every secret-bearing scanner field with [REDACTED]. From a package, the evidence names the releases that ship the secret.

Identity: location
Sources: repository, endpoint, storage_bucket, cloud_resource, package
Targets: secret
Self edge: no
Checks: secret_plaintext_keys.1
Canonicalizations: —

Property	Required	Rule	Meaning
location	yes	printable_text_1024	Where the secret appears, such as a file path or URL path; identity-bearing.

federates_with

The name signs users in through the identity tenant.

Not modeled: Not ownership of the tenant by the name's registrant.

Identity: —
Sources: domain, subdomain
Targets: identity_tenant
Self edge: no
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
namespace_type	no	one of managed, federated	How the realm lookup classifies the name: managed or federated.

has_contact

The source publishes the contact for one role, including a CAA iodef report address or URL.

Not modeled: Not a person record; person and company types are out of scope.

Use published for an address harvested from an organization's own surface with no declared role. Registrant, admin, tech and billing contacts come from registration data and attach to the whois_registration, so a re-registration does not inherit them. A package lists only maintainer and security email addresses, and only a package has a maintainer.

Identity: role
Sources: organization, registrar, domain, subdomain, repository, whois_registration, package
Targets: email_address, phone, endpoint
Self edge: no
Checks: has_contact_registration_roles.2, has_contact_endpoint_role.1
Canonicalizations: —

Property	Required	Rule	Meaning
role	yes	one of abuse, admin, tech, registrant, billing, noc, security, published, iodef, maintainer	What the contact is for; identity-bearing, so one address may hold several roles.

has_dkim_selector

The name publishes the DKIM selector; the scope relation of dkim_record.

Not modeled: Not a DNS delegation or subdomain relation.

Identity: —
Sources: domain, subdomain
Targets: dkim_record
Self edge: no
Checks: —
Canonicalizations: —

has_dmarc

The name publishes the DMARC record at _dmarc.<name>.

Not modeled: Not a _dmarc subdomain node.

Identity: —
Sources: domain, subdomain
Targets: dmarc_record
Self edge: no
Checks: —
Canonicalizations: —

has_finding

The finding is about the source object; the scope relation of finding.

Not modeled: Never from shared vocabulary such as a technology, fingerprint or advisory, which unrelated hosts share.

Identity: —
Sources: port, domain, subdomain, ip_address, ip_cidr, service, endpoint, certificate, parameter, dkim_record, storage_bucket, repository, identity_tenant, secret, mta_sts_policy, whois_registration, cloud_account, cloud_resource, package
Targets: finding
Self edge: no
Checks: —
Canonicalizations: —

has_http_fingerprint

The endpoint's response carries the fingerprint.

Not modeled: Not ownership: a shared fingerprint clusters, it does not attribute.

Identity: —
Sources: endpoint
Targets: http_fingerprint
Self edge: no
Checks: —
Canonicalizations: —

has_mail_exchange

An MX record at the source names the target as a mail exchanger.

Not modeled: Not an address record; resolve the exchanger separately.

Identity: preference
Sources: domain, subdomain
Targets: domain, subdomain
Self edge: yes
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
preference	yes	uint16	The MX preference; identity-bearing.

has_mta_sts_policy

The name publishes the MTA-STS policy record; its scope relation.

Not modeled: Not an _mta-sts subdomain node.

Identity: —
Sources: domain, subdomain
Targets: mta_sts_policy
Self edge: no
Checks: —
Canonicalizations: —

has_nameserver

An NS record at the source delegates it to the target name server.

Not modeled: Not the SOA primary (has_soa_primary).

Identity: —
Sources: domain, subdomain
Targets: domain, subdomain
Self edge: yes
Checks: —
Canonicalizations: —

has_open_port

The address has the port open; the scope relation of port.

Not modeled: Not a closed or filtered port.

Identity: —
Sources: ip_address
Targets: port
Self edge: no
Checks: —
Canonicalizations: —

has_parameter

The endpoint accepts the parameter; the scope relation of parameter.

Not modeled: Not a parameter value.

Identity: —
Sources: endpoint
Targets: parameter
Self edge: no
Checks: —
Canonicalizations: —

has_registration

The domain has this registration; the scope relation of whois_registration.

Not modeled: Not a registrar relationship, which is registered_through from the registration.

Identity: —
Sources: domain
Targets: whois_registration
Self edge: no
Checks: has_registration_suffix_match.1
Canonicalizations: —

has_service

The port speaks the service; the scope relation of service.

Not modeled: Not the product implementing it (runs_technology).

Identity: —
Sources: port
Targets: service
Self edge: no
Checks: —
Canonicalizations: —

has_soa_primary

The SOA record at the source names the target as its primary name server.

Not modeled: Not an NS delegation (has_nameserver).

Identity: —
Sources: domain, subdomain
Targets: domain, subdomain
Self edge: yes
Checks: —
Canonicalizations: —

has_spf

The name publishes the SPF record.

Not modeled: Not a malformed SPF-like TXT value (has_txt_record).

Identity: —
Sources: domain, subdomain
Targets: spf_record
Self edge: no
Checks: —
Canonicalizations: —

has_srv_target

An SRV record at the source names the target host for a service.

Not modeled: Not an open port observation; the SRV port is what the record publishes.

Identity: service, protocol, port, priority, weight
Sources: domain, subdomain
Targets: domain, subdomain
Self edge: yes
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
port	yes	uint16	The published target port.
priority	yes	uint16	The SRV priority.
protocol	yes	srv_label	The SRV protocol label, with its underscore.
service	yes	srv_label	The SRV service label, with its underscore.
weight	yes	uint16	The SRV weight.

has_subdomain

The target name lies below the source name.

Not modeled: Not a DNS delegation; the relation is naming structure, checked on write.

Identity: —
Sources: domain, subdomain
Targets: subdomain
Self edge: no
Checks: has_subdomain_suffix.1
Canonicalizations: —

has_svcb_binding

An HTTPS or SVCB record at the source binds it to the target, which may be the owner itself.

Not modeled: Never an AliasMode record whose target is ., the wire's negative answer.

Write it only after parsing SvcParams: alpn: [] asserts the record carries no ALPN parameter.

Identity: record_type, priority, alpn, with alpn hashed order-independently
Sources: domain, subdomain
Targets: domain, subdomain
Self edge: yes
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
alpn	yes	alpn_tokens	ALPN ids from SvcParams, hashed order-independently.
priority	yes	uint16	The SvcPriority; 0 is AliasMode.
record_type	yes	one of https, svcb	Whether the record is HTTPS or SVCB.

has_tls_fingerprint

The service's TLS stack has the fingerprint.

Not modeled: Not a host identity: a shared fingerprint clusters stacks.

Identity: —
Sources: service
Targets: tls_fingerprint
Self edge: no
Checks: —
Canonicalizations: —

has_txt_record

The name publishes the TXT value.

Not modeled: Not a value that belongs to a dedicated TXT type.

Identity: —
Sources: domain, subdomain
Targets: txt_record
Self edge: no
Checks: —
Canonicalizations: —

has_weakness

The finding or advisory is an instance of the CWE weakness class.

Not modeled: Not a claim of exploitability.

Identity: —
Sources: finding, advisory
Targets: cwe
Self edge: no
Checks: —
Canonicalizations: —

hosted_on

A name or URL serves from the cloud resource, typically through a CNAME to its default hostname.

Not modeled: Not ownership of the resource; in_account records whose account it is.

Identity: —
Sources: domain, subdomain, endpoint
Targets: cloud_resource
Self edge: no
Checks: —
Canonicalizations: —

in_account

The cloud resource, bucket or container image belongs to the account.

Not modeled: Not the account's identity provider, which is an identity_tenant.

An image belongs to an account only when its oci purl names a cloud provider's registry: an ECR image to the AWS account its <account>.dkr.ecr.<region>.amazonaws.com(.cn) host names, an Artifact Registry or gcr.io image to its GCP project, an ACR image to its Azure subscription. A Docker Hub or GHCR image has no account.

Identity: —
Sources: cloud_resource, storage_bucket, package
Targets: cloud_account
Self edge: no
Checks: in_account_provider_match.2
Canonicalizations: —

issued_by

The certificate was issued by the target certificate; a self edge marks a self-signed one.

Not modeled: Not trust-store validation, which depends on the observer.

Identity: —
Sources: certificate
Targets: certificate
Self edge: yes
Checks: —
Canonicalizations: —

links_to

The source page references the target URL, through one HTML element.

Not modeled: Not an HTTP redirect (redirects_to) and not a URL guessed by brute force.

Identity is element, so a script include and an anchor to one URL are two edges; attribute is last-writer-wins. Use "" when the crawler reports no element.

Identity: element
Sources: endpoint
Targets: endpoint
Self edge: yes
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
element	yes	html_token_or_empty	The referencing HTML element, such as a or script, or empty.
attribute	no	html_token	The attribute that held the URL, such as href or src.

loads_package

The endpoint loads the target's own published package, such as a script bundle from npm.

Not modeled: Not a third-party component, which is a technology reached through runs_technology with its version. Not a release: the loaded version stays in evidence.

Identity: —
Sources: endpoint
Targets: package
Self edge: no
Checks: —
Canonicalizations: —

operated_by

The AS or network is held by the RIR organization.

Not modeled: Not domain registration, which has no RIR handle to key on.

Identity: —
Sources: asn, ip_cidr
Targets: organization
Self edge: no
Checks: —
Canonicalizations: —

owns_repository

The name's owner is attributed the repository.

Not modeled: Not proof of ownership: it is an attribution claim that needs evidence.

Identity: —
Sources: domain, subdomain
Targets: repository
Self edge: no
Checks: —
Canonicalizations: —

presents_certificate

The service presented the certificate in a handshake.

Not modeled: Not the names the certificate covers (covers_name).

Identity: mode, server_name, alpn_offered, with alpn_offered hashed order-independently
Sources: service
Targets: certificate
Self edge: no
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
alpn_offered	yes	alpn_tokens	The ALPN ids offered, hashed order-independently.
mode	yes	one of tls, dtls, starttls, quic	How TLS was reached on the service.
server_name	yes	dns_or_explicit_empty	The SNI name offered, or empty when none was.
name_mismatch	no	boolean	True when the certificate did not cover the name that was asked for.

presents_host_key

The SSH service presented the host key.

Not modeled: Not a claim that two services are one host, though a shared key suggests it.

Identity: —
Sources: service
Targets: host_key
Self edge: no
Checks: —
Canonicalizations: —

protected_by

Traffic to the source passes through the technology acting as a WAF, CDN, reverse proxy or load balancer.

Not modeled: Not a range-list classification of an address, and not SaaS hosting (runs_technology).

Identity: kind
Sources: service, endpoint, domain, subdomain
Targets: technology
Self edge: no
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
kind	yes	one of waf, cdn, reverse_proxy, load_balancer	The role the technology plays in front of the source.

published_from

The package is built and published from the source repository.

Not modeled: Not a repository the package depends on or mirrors, and not attribution: owns_repository attributes the repository to a name.

Identity: —
Sources: package
Targets: repository
Self edge: no
Checks: —
Canonicalizations: —

redirects_to

The endpoint answered with an HTTP redirect to the target endpoint.

Not modeled: Not a client-side or meta refresh redirect.

Identity: status
Sources: endpoint
Targets: endpoint
Self edge: yes
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
status	yes	redirect_status	The redirect status code; identity-bearing.

registered_through

The registration is sponsored by the registrar.

Not modeled: Not a fact about the name across time: after a transfer or a re-registration, each registration keeps its own registrar edge.

Identity: —
Sources: whois_registration
Targets: registrar
Self edge: no
Checks: —
Canonicalizations: —

resolves_to

The name resolves to the address through an A or AAAA record.

Not modeled: Not a PTR record (reverse_resolves_to).

Identity: —
Sources: domain, subdomain
Targets: ip_address
Self edge: no
Checks: —
Canonicalizations: —

reverse_resolves_to

A PTR record for the address names the target.

Not modeled: Not forward resolution (resolves_to).

Identity: —
Sources: ip_address
Targets: domain, subdomain
Self edge: no
Checks: —
Canonicalizations: —

runs_technology

The source runs the technology, including a name pointing at a SaaS host.

Not modeled: Not a protective front such as a WAF or CDN (protected_by).

Identity: —
Sources: service, endpoint, domain, subdomain
Targets: technology
Self edge: no
Checks: —
Canonicalizations: —

Property	Required	Rule	Meaning
cpe	no	cpe23	The versioned CPE 2.3 name for what this source runs.
version	no	tech_version	The version this source runs, as the product reports it.

serves_endpoint

The service serves the endpoint.

Not modeled: Not a redirect target (redirects_to).

Identity: —
Sources: service
Targets: endpoint
Self edge: no
Checks: —
Canonicalizations: —

supports_tls_cipher

The service accepts the cipher suite.

Not modeled: Not the suite negotiated in one session.

Identity: —
Sources: service
Targets: tls_cipher_suite
Self edge: no
Checks: —
Canonicalizations: —