package scalibr
Get desktop application:
View/edit binary Protocol Buffers messages
message
scan_result.proto:343The additional data found in APK packages.
Used in:
string package_name = 1
string origin_name = 2
string os_id = 3
string os_version_id = 4
string maintainer = 5
string architecture = 6
message
scan_result.proto:292A unique identifier per advisory.
Used in:
string publisher = 1
e.g. "CVE".
string reference = 2
e.g. "CVE-2023-1234".
message
scan_result.proto:641Used in:
string tool_name = 1
string tool_version = 2
message
scan_result.proto:1039Used in:
repeated base_images = 1
List of potential base images (repositories that have a matching ChainID).
string chain_id = 2
Chain ID of the last layer in the image.
message
scan_result.proto:1046Used in:
string repository = 1
Name of the image. (e.g. `debian`, `circleci/node`)
string registry = 2
Name of the registry. (e.g. `docker.io`, `ghcr.io`)
string plugin = 3
Name of the plugin used to extract the base image.
message
scan_result.proto:516The additional data for packages extracted from CDX files.
Used in:
optional purl = 1
repeated string cpes = 2
message
scan_result.proto:390The additional data found in COS packages.
Used in:
string name = 1
string version = 2
string category = 3
string os_version = 4
string os_version_id = 5
string ebuild_version = 6
message
scan_result.proto:596The additional data found in Chrome extensions.
Used in:
string name = 1
string description = 2
string author_email = 3
repeated string host_permissions = 4
int32 manifest_version = 5
string minimum_chrome_version = 6
repeated string permissions = 7
string update_url = 8
message
scan_result.proto:1018Used in:
string command = 1
message
scan_result.proto:1022Used in:
int32 index = 1
repeated layer_metadata = 2
Layers are ordered from the earliest to the latest.
repeated base_image_chains = 3
The base images that make up the chain. The first base image is always empty, acting as a placeholder for the scanned image itself. If the scanned image is a base image, there will be no layers pointing to the first base image. The base images are ordered from the biggest base image containing all base images to the smallest. e.g. [empty, postgresql, alpine]
map<string, string> os_info = 4
Key value map of OS info from /etc/os-release.
message
scan_result.proto:561Used in:
string namespace_name = 1
string image_name = 2
string image_digest = 3
string runtime = 4
int32 pid = 5
string snapshotter = 6
string snapshot_key = 7
string lower_dir = 8
string upper_dir = 9
string work_dir = 10
string id = 11
string pod_name = 12
string pod_namespace = 13
message
scan_result.proto:577Used in:
string namespace_name = 1
string image_name = 2
string image_digest = 3
string runtime = 4
string id = 5
int32 pid = 6
string rootfs_path = 7
message
scan_result.proto:421The additional data found in .NET deps json packages.
Used in:
string package_name = 1
string package_version = 2
string type = 3
message
scan_result.proto:358The additional data found in DPKG packages. Next ID: 11
Used in:
string package_name = 1
string source_name = 2
string source_version = 3
string package_version = 4
string os_id = 5
string os_version_codename = 6
string os_version_id = 7
string maintainer = 8
string architecture = 9
string status = 10
message
scan_result.proto:634Used in:
string image_name = 1
string image_digest = 2
string id = 3
repeated ports = 4
message
scan_result.proto:654Used in:
string ip = 1
uint32 private_port = 2
uint32 public_port = 3
string type = 4
message
scan_result.proto:1014Used in:
string name = 1
message
scan_result.proto:72Used in:
string file_path = 1
string error_message = 2
message
scan_result.proto:1005Used in:
string path = 1
message
scan_result.proto:1009Used in:
string path = 1
optional layer_details = 2
message
scan_result.proto:215FindingExploitabilitySignal is used to indicate that a finding is not exploitable.
Used in:
string plugin = 1
The name of the plugin (e.g. Annotator) that added this signal.
VexJustification justification = 2
Reason for exclusion.
message
scan_result.proto:448The additional data found in Flatpak packages.
Used in:
string package_name = 1
string package_id = 2
string package_version = 3
string release_date = 4
string os_name = 5
string os_id = 6
string os_version_id = 7
string os_build_id = 8
string developer = 9
message
scan_result.proto:264Describes generic security findings not associated with any specific package, e.g. weak credentials.
Used in: ,
optional adv = 1
Info specific to the finding. Should always be the same for the same type of finding.
optional target = 2
Instance-specific info such as location of the vulnerable files.
repeated string plugins = 4
The plugins (e.g. Detectors, Enrichers) that found this vuln.
repeated exploitability_signals = 5
Signals that indicate this finding is not exploitable.
message
scan_result.proto:280Describes a security finding and how to remediate it. It should not contain any information specific to the target (e.g. which files were found vulnerable).
Used in:
optional id = 1
A unique ID for the finding.
string title = 3
string description = 4
string recommendation = 5
Remediation instructions, e.g. "update to latest version".
SeverityEnum sev = 7
message
scan_result.proto:307Instance-specific details about the generic security finding.
Used in:
string extra = 4
Free-text info.
message
scan_result.proto:593The additional data found in Homebrew packages.
Used in:
(message has no fields)
message
scan_result.proto:46The artifacts (e.g. software inventory, security findings) that a scan found.
Used in:
repeated packages = 1
repeated generic_findings = 2
repeated secrets = 3
repeated container_image_metadata = 5
message
scan_result.proto:522The additional data found in Java JAR packages.
Used in:
string artifact_id = 2
string group_id = 3
string sha1 = 4
message
scan_result.proto:529The additional data found in Java lockfiles.
Used in:
string artifact_id = 1
string group_id = 2
repeated string dep_group_vals = 3
bool is_transitive = 4
message
scan_result.proto:320The additional data found in npm packages.
Used in:
string author = 1
repeated string maintainers = 2
repeated string contributors = 3
PackageSource source = 5
message
scan_result.proto:461The additional data found in MODULE packages.
Used in:
string package_name = 1
string package_version = 2
string package_vermagic = 3
string package_source_version_identifier = 4
string os_id = 5
string os_version_codename = 6
string os_version_id = 7
string package_author = 8
message
scan_result.proto:177Details about the layer a package was found in.
Used in:
int32 index = 1
The index of the layer in the container image.
string diff_id = 2
The diff ID (typically a sha256 hash) of the layer in the container image.
string chain_id = 5
The layer chain ID (sha256 hash) of the layer in the container image. https://github.com/opencontainers/image-spec/blob/main/config.md#layer-chainid
string command = 3
The layer build command that was used to build the layer. This may not be found in all layers depending on how the container image is built.
bool in_base_image = 4
Denotes whether the layer is in the base image.
message
scan_result.proto:1055Used in:
int32 index = 1
The index of the layer within the ContainerImageMetadata.layer_metadata field.
string diff_id = 2
string chain_id = 3
string command = 4
The command that was used to build the layer.
bool is_empty = 5
Whether the layer is empty (currently always false).
int32 base_image_index = 6
The index of the base image match within the ContainerImageMetadata.base_image_chains field.
message
scan_result.proto:996Used in:
oneof location
filepath = 1
filepath_with_layer_details = 2
environment_variable = 3
container_command = 4
message
scan_result.proto:489The additional data found in Mac Applications.
Used in:
string bundle_display_name = 1
string bundle_identifier = 2
string bundle_short_version_string = 3
string bundle_executable = 4
string bundle_name = 5
string bundle_package_type = 6
string bundle_signature = 7
string bundle_version = 8
string product_id = 9
string update_url = 10
message
scan_result.proto:503The additional data found in Macports packages.
Used in:
string package_name = 1
string package_version = 2
string package_revision = 3
message
scan_result.proto:555Used to report open ports on a system.
Used in:
uint32 port = 1
string protocol = 2
string command_line = 3
message
scan_result.proto:410The additional data found in Nix packages.
Used in:
string package_name = 1
string package_version = 2
string package_hash = 3
string package_output = 4
string os_id = 5
string os_version_codename = 6
string os_version_id = 7
message
scan_result.proto:650Used in:
string nodejs_version = 2
message
scan_result.proto:646Used in:
string nodejs_version = 2
message
scan_result.proto:537The additional data for packages extracted by an OSV extractor wrapper.
Used in:
string purl_type = 1
string commit = 2
string ecosystem = 3
string compare_as = 4
message
scan_result.proto:400The additional data found in PACMAN packages.
Used in:
string package_name = 1
string package_version = 2
string os_id = 3
string os_version_id = 4
string package_description = 5
string package_dependencies = 6
message
scan_result.proto:79A software package or library found by an extractor. PURL or CPE needs to be set, maybe both.
Used in: ,
string name = 11
Human-readable name of the software, to be used for things like logging. For vuln matching, use the name from metadata.
string version = 12
Version of the package.
optional source_code = 26
Source code level package identifiers.
optional purl = 1
Package URL of the software.
string ecosystem = 27
Ecosystem - For software packages this corresponds to an OSV ecosystem value, e.g. PyPI.
repeated string locations = 2
Paths or source of files related to the package.
string extractor_deprecated = 10
TODO(b/400910349): Remove once integrators stop using these fields.
repeated string plugins = 49
The names of the plugins that found this software. Set by the core library.
oneof metadata
The additional data found in the package. LINT.IfChange
python_metadata = 5
javascript_metadata = 6
apk_metadata = 7
dpkg_metadata = 8
rpm_metadata = 9
cos_metadata = 13
depsjson_metadata = 40
spdx_metadata = 14
java_archive_metadata = 15
java_lockfile_metadata = 31
pacman_metadata = 36
nix_metadata = 37
kernel_module_metadata = 38
vmlinuz_metadata = 39
portage_metadata = 41
osv_metadata = 16
netports_metadata = 45
python_requirements_metadata = 21
python_setup_metadata = 44
containerd_container_metadata = 22
snap_metadata = 23
flatpak_metadata = 24
mac_apps_metadata = 34
containerd_runtime_container_metadata = 25
cdx_metadata = 30
windows_os_version_metadata = 33
homebrew_metadata = 42
chrome_extensions_metadata = 47
vscode_extensions_metadata = 46
podman_metadata = 50
docker_containers_metadata = 48
macports_metadata = 53
winget_metadata = 54
asdf_metadata = 55
nvm_metadata = 56
nodeversion_metadata = 58
repeated Package.AnnotationEnum annotations_deprecated = 28
Deprecated - use exploitability_signals instead TODO(b/400910349): Remove once integrators stop using this.
repeated exploitability_signals = 51
Signals to indicate that specific vulnerabilities are not applicable to this package.
repeated string licenses = 52
Software licenses information
optional container_image_metadata_indexes = 57
Used in:
UNSPECIFIED = 0
TRANSITIONAL = 1
INSIDE_OS_PACKAGE = 2
INSIDE_CACHE_DIR = 3
message
scan_result.proto:159Used in:
int32 container_image_index = 1
The index of ContainerImageMetadata in Inventory.ContainerImageMetadata list.
int32 layer_index = 2
The index of LayerMetadata in ContainerImageMetadata.LayerMetadata list.
message
scan_result.proto:194PackageExploitabilitySignal is used to indicate that specific vulnerabilities are not applicable to a given package.
Used in:
string plugin = 1
The name of the plugin (e.g. Annotator) that added this signal.
VexJustification justification = 2
Reason for exclusion.
oneof vuln_filter
vuln_identifiers = 3
Advisory Identifier (CVE, GHSA, ...) and aliases of the vulns that are not applicable to this package.
bool matches_all_vulns = 4
Indicates that all vulnerabilities associated with the package are irrelevant.
The source of the package.
Used in:
UNKNOWN = 0
PUBLIC_REGISTRY = 1
PUBLIC_REGISTRY is the public NPM registry.
OTHER = 2
OTHER is any other remote or private source (e.g. Github). This is used for packages that are not found in the public NPM registry.
LOCAL = 3
LOCAL is the local filesystem that stores the package versions. This is used for when the package is locally-developed or -installed.
message
scan_result.proto:66Used in:
string name = 1
int32 version = 2
optional status = 3
message
scan_result.proto:619The additional data found in Podman containers.
Used in:
map<uint32, > exposed_ports = 1
int32 pid = 2
string namespace_name = 3
optional started_time = 4
optional finished_time = 5
string status = 6
int32 exit_code = 7
bool exited = 8
message
scan_result.proto:440The additional data found in portage packages.
Used in:
string package_name = 1
string package_version = 2
string os_id = 3
string os_version_id = 4
message
scan_result.proto:630Used in:
repeated string names = 1
message
scan_result.proto:240Package URL, see https://github.com/package-url/purl-spec
Used in: , ,
string purl = 1
String representation.
string type = 2
Package type, e.g. "maven, npm, pypi".
string name = 3
Package name.
string version = 4
Package version.
string namespace = 5
Name prefix such as a Maven groupid, or Docker image owner.
repeated qualifiers = 6
Extra qualifying data for a package such as an OS, architecture, etc.
string subpath = 7
Extra subpath within a package, relative to the package root.
message
scan_result.proto:314The additional data found in python packages.
Used in:
string author = 1
string author_email = 2
message
scan_result.proto:544Used in:
repeated string hash_checking_mode_values = 1
string version_comparator = 2
string requirement = 3
message
scan_result.proto:550Used in:
string version_comparator = 2
message
scan_result.proto:257Used in:
string key = 1
string value = 2
message
scan_result.proto:372The additional data found in RPM packages.
Used in:
string package_name = 1
string source_rpm = 2
int32 epoch = 3
string os_id = 4
string os_version_id = 5
string os_build_id = 6
string os_name = 7
string vendor = 8
string architecture = 9
string os_pretty_name = 11
message
scan_result.proto:428The additional data found in SNAP packages.
Used in:
string name = 1
string version = 2
string grade = 3
string type = 4
repeated string architectures = 5
string os_id = 6
string os_version_codename = 7
string os_version_id = 8
message
scan_result.proto:510The additional data for packages extracted from SPDX files.
Used in:
optional purl = 1
repeated string cpes = 2
message
scan_result.proto:31The results of a scan incl. scan status and artifacts found.
string version = 1
optional start_time = 2
optional end_time = 3
optional status = 4
Status of the overall scan.
repeated plugin_status = 5
Status and versions of the plugins that ran.
repeated inventories_deprecated = 6
TODO(b/400910349): Remove once integrators stop using these fields.
repeated findings_deprecated = 7
optional inventory = 8
message
scan_result.proto:53Used in: ,
ScanStatus.ScanStatusEnum status = 1
string failure_reason = 2
repeated file_errors = 4
Used in:
UNSPECIFIED = 0
SUCCEEDED = 1
PARTIALLY_SUCCEEDED = 2
FAILED = 3
message
scan_result.proto:673A secret (i.e. credential) found by Veles secret scanning.
Used in:
optional secret = 1
optional status = 2
repeated locations = 3
message
scan_result.proto:679Used in:
oneof secret
gcpsak = 1
anthropic_workspace_api_key = 2
anthropic_model_api_key = 3
perplexity = 4
private_key = 5
grok_xai_api_key = 6
grok_xai_management_api_key = 7
docker_hub_pat = 8
digitalocean = 9
openai_api_key = 10
postman_api_key = 11
postman_collection_access_token = 12
azure_access_token = 13
azure_identity_token = 14
tink_keyset = 15
gitlab_pat = 16
hashicorp_vault_token = 17
hashicorp_vault_app_role_credentials = 18
gcp_api_key = 19
hugginface = 20
github_app_refresh_token = 21
stripe_secret_key = 22
stripe_restricted_key = 23
stripe_webhook_secret = 24
gcp_oauth2_client_credentials = 25
gcp_oauth2_access_token = 26
github_app_server_to_server_token = 27
github_classic_personal_access_token = 28
github_fine_grained_personal_access_token = 29
github_app_user_to_server_token = 30
github_oauth_token = 31
slack_app_config_refresh_token = 33
slack_app_level_token = 34
slack_app_config_access_token = 35
azure_storage_account_access_key = 36
hashicorp_cloud_platform_credentials = 37
hashicorp_cloud_platform_token = 38
onepassword_secret_key = 39
onepassword_service_token = 40
onepassword_recovery_code = 41
onepassword_connect_token = 42
pgpass = 43
pypi = 44
crates_io_api_token = 45
maria_db_credentials = 46
message
scan_result.proto:755Used in:
string key = 1
The Anthropic Model API key (regular API key for model access).
message
scan_result.proto:750Used in:
string key = 1
The Anthropic Workspace API key (contains "admin01").
message
scan_result.proto:781Used in:
string token = 1
message
scan_result.proto:801Used in:
string token = 1
message
scan_result.proto:772Used in:
string key = 1
message
scan_result.proto:842Used in:
string token = 1
message
scan_result.proto:838Used in:
string key = 1
message
scan_result.proto:809Used in:
string pat = 1
string username = 2
message
scan_result.proto:889Used in:
string key = 1
message
scan_result.proto:938Used in:
string token = 1
GCP OAuth2 access token, typically in format: "ya29.[alphanumeric_string]"
message
scan_result.proto:929Used in:
string id = 1
GCP OAuth2 client ID in format: `12345678901-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com`
string secret = 2
GCP OAuth2 client secret, typically 24+ character alphanumeric string prefixed with `GOCSPX-`
message
scan_result.proto:729Used in:
string private_key_id = 1
Always filled.
string client_email = 2
bytes signature = 3
derived from the private_key for validation
string type = 4
Filled only when explicitly requested.
string project_id = 5
string client_id = 6
string auth_uri = 7
string token_uri = 8
string auth_provider_x509_cert_url = 9
string client_x509_cert_url = 10
string universe_domain = 11
string private_key = 12
Should not be filled out unless very explicitly requested accepting the risk that this might accidentally leak the key.
message
scan_result.proto:846Used in:
string token = 1
message
scan_result.proto:850Used in:
string token = 1
message
scan_result.proto:866Used in:
string token = 1
message
scan_result.proto:854Used in:
string token = 1
message
scan_result.proto:858Used in:
string token = 1
message
scan_result.proto:862Used in:
string token = 1
message
scan_result.proto:814Used in:
string pat = 1
message
scan_result.proto:764Used in:
string key = 1
message
scan_result.proto:768Used in:
string key = 1
message
scan_result.proto:899Used in:
string client_id = 1
string client_secret = 2
message
scan_result.proto:904Used in:
string token = 1
string organization_id = 2
Optional identity enrichment fields populated when available
string project_id = 3
string principal_id = 4
string principal_type = 5
string service_name = 6
string user_id = 7
string user_email = 8
repeated string group_ids = 9
message
scan_result.proto:882Used in:
string role_id = 1
string secret_id = 2
string id = 3
General ID field for uncertain UUID types when context is unclear
message
scan_result.proto:878Used in:
string token = 1
message
scan_result.proto:893Used in:
string key = 1
string role = 2
repeated string fine_grained_scope = 3
message
scan_result.proto:793Used in:
string host = 1
string port = 2
string user = 4
string password = 5
string section = 6
message
scan_result.proto:944Used in:
string device_uuid = 1
Device UUID from the token JSON.
string version = 2
Version field from the token JSON.
string encrypted_data = 3
Encrypted payload data (from encCredentials.data).
string encryption_key_id = 4
Key ID used to encrypt the credentials (encCredentials.kid).
string iv = 5
Initialization vector (encCredentials.iv).
string unique_key_id = 6
Unique key kid (uniqueKey.kid).
string verifier_salt = 7
Verifier salt (verifier.salt).
string verifier_local_hash = 8
Verifier local hash (verifier.localHash).
message
scan_result.proto:970Used in:
string key = 1
message
scan_result.proto:963Used in:
string key = 1
message
scan_result.proto:966Used in:
string key = 1
message
scan_result.proto:805Used in:
string key = 1
message
scan_result.proto:760Used in:
string key = 1
message
scan_result.proto:785Used in:
string hostname = 1
string port = 2
string database = 3
string username = 4
string password = 5
message
scan_result.proto:830Used in:
string key = 1
message
scan_result.proto:834Used in:
string key = 1
message
scan_result.proto:776Used in:
string block = 1
PEM/OpenSSH private key block
bytes der = 2
DER-encoded key material
message
scan_result.proto:870Used in:
string token = 1
message
scan_result.proto:822Used in:
string token = 1
message
scan_result.proto:826Used in:
string token = 1
message
scan_result.proto:818Used in:
string token = 1
message
scan_result.proto:921Used in:
string key = 1
message
scan_result.proto:917Used in:
string key = 1
message
scan_result.proto:925Used in:
string key = 1
message
scan_result.proto:874Used in:
string content = 1
JSON encoded Tink keyset
message
scan_result.proto:975Used in:
SecretStatus.SecretStatusEnum status = 1
optional last_updated = 2
Used in:
UNSPECIFIED = 0
The default value for SecretStatusEnum. Set when no validation was attempted.
UNKNOWN = 1
Deprecated. Use UNSPECIFIED instead.
INVALID = 2
The secret is confirmed to be invalid.
VALID = 3
The secret is confirmed to be valid.
UNSUPPORTED = 4
Validating the secret is not supported by the scanner.
FAILED = 5
Validation is supported but the validation failed.
Used in:
SEVERITY_UNSPECIFIED = 0
MINIMAL = 1
LOW = 2
MEDIUM = 3
HIGH = 4
CRITICAL = 5
message
scan_result.proto:171Additional identifiers for source code software packages (e.g. NPM).
Used in:
string repo = 1
string commit = 2
message
scan_result.proto:608The additional data found in VSCode extensions.
Used in:
string id = 1
string publisher_id = 2
string publisher_display_name = 3
string target_platform = 4
bool updated = 5
bool is_pre_release_version = 6
int64 installed_timestamp = 7
Vuln exclusion reasons - Mirrors the format from the official VEX documentation (https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf)
Used in: ,
VEX_JUSTIFICATION_UNSPECIFIED = 0
COMPONENT_NOT_PRESENT = 1
The vulnerable component is not used in the affected artifact.
VULNERABLE_CODE_NOT_PRESENT = 2
The component is used but vulnerable code was removed or not included.
VULNERABLE_CODE_NOT_IN_EXECUTE_PATH = 3
Vulnerable code is included but is not executed.
VULNERABLE_CODE_CANNOT_BE_CONTROLLED_BY_ADVERSARY = 4
Vulnerable code is executed but can't be exploited due to program logic.
INLINE_MITIGATION_ALREADY_EXISTS = 5
Code can be executed but additional mitigations prevent exploitation.
message
scan_result.proto:473The additional data found in Vmlinuz packages.
Used in:
string name = 1
string version = 2
string architecture = 3
string extended_version = 4
string format = 5
int32 swap_device = 6
int32 root_device = 7
string video_mode = 8
string os_id = 9
string os_version_codename = 10
string os_version_id = 11
bool rw_root_fs = 12
message
scan_result.proto:209Used in:
repeated string identifiers = 1
message
scan_result.proto:587Used in:
string product = 1
string full_version = 2
message
scan_result.proto:662The additional data found in Windows Package Manager (Winget) packages.
Used in:
string name = 1
string id = 2
string version = 3
string moniker = 4
string channel = 5
repeated string tags = 6
repeated string commands = 7