Signals¶

Signal Envelope¶

All signals are submitted inside an EvaluationRequest:

{
  "apiVersion": "ores.dev/v1",
  "kind": "EvaluationRequest",
  "signals": {
    "<signal_name>": { ... },
    "<signal_name>": { ... }
  }
}

The signals map keys are signal type names (listed below). Each value is the signal-specific payload described in this catalog.

At a Glance¶

ORES ships with eight built-in signal types across four scoring dimensions:

Signal Reference¶

cvss¶

The CVSS signal accepts a base score or vector string from any CVSS version (v2, v3.x, v4).

When both fields are provided, base_score is used for scoring. The vector field is accepted for reference but is not parsed by the current engine version.

severity = base_score / 10.0

signals:
  cvss:
    base_score: 9.8
    vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"

{
  "signals": {
    "cvss": {
      "base_score": 9.8,
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  }
}

nist¶

The NIST signal provides the qualitative severity classification used in the National Vulnerability Database (NVD).

signals:
  nist:
    severity: critical
    cwe: "CWE-89"

{
  "signals": {
    "nist": {
      "severity": "critical",
      "cwe": "CWE-89"
    }
  }
}

epss¶

The EPSS signal provides exploit prediction data from the Exploit Prediction Scoring System.

signals:
  epss:
    probability: 0.91
    percentile: 0.98

{
  "signals": {
    "epss": {
      "probability": 0.91,
      "percentile": 0.98
    }
  }
}

threat_intel¶

The threat_intel signal captures confirmed threat activity from intelligence sources such as CISA KEV, vendor advisories, or in-house threat feeds.

signals:
  threat_intel:
    actively_exploited: true
    ransomware_associated: false

{
  "signals": {
    "threat_intel": {
      "actively_exploited": true,
      "ransomware_associated": false
    }
  }
}

asset¶

The asset signal describes the characteristics of the system exposed to the vulnerability — its business importance, network position, and data sensitivity.

signals:
  asset:
    criticality: crown_jewel
    network_exposure: true
    data_classification: pii

{
  "signals": {
    "asset": {
      "criticality": "crown_jewel",
      "network_exposure": true,
      "data_classification": "pii"
    }
  }
}

blast_radius¶

The blast_radius signal estimates the potential scope of a successful exploit — how many systems could be affected and whether lateral movement is possible.

blast_scope = min(log10(affected_systems) / log10(1000), 1.0)

signals:
  blast_radius:
    affected_systems: 250
    lateral_movement_possible: true

{
  "signals": {
    "blast_radius": {
      "affected_systems": 250,
      "lateral_movement_possible": true
    }
  }
}

patch¶

The patch signal describes the remediation posture — whether a fix exists, how long it has been available, and whether compensating controls are in place.

signals:
  patch:
    patch_available: true
    patch_age_days: 60
    compensating_control: false

{
  "signals": {
    "patch": {
      "patch_available": true,
      "patch_age_days": 60,
      "compensating_control": false
    }
  }
}

compliance¶

The compliance signal describes the regulatory and compliance context for the affected system.

compliance_scope = min(len(frameworks_affected) / 5.0, 1.0)

signals:
  compliance:
    frameworks_affected:
      - PCI-DSS
      - SOC2
      - HIPAA
    regulatory_impact: high

{
  "signals": {
    "compliance": {
      "frameworks_affected": ["PCI-DSS", "SOC2", "HIPAA"],
      "regulatory_impact": "high"
    }
  }
}

Complete Example¶

Here is a full EvaluationRequest with all eight signals populated:

apiVersion: ores.dev/v1
kind: EvaluationRequest
signals:
  cvss:
    base_score: 9.8
    vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  nist:
    severity: critical
    cwe: "CWE-89"
  epss:
    probability: 0.91
    percentile: 0.98
  threat_intel:
    actively_exploited: true
    ransomware_associated: true
  asset:
    criticality: crown_jewel
    network_exposure: true
    data_classification: restricted
  blast_radius:
    affected_systems: 500
    lateral_movement_possible: true
  patch:
    patch_available: true
    patch_age_days: 45
    compensating_control: false
  compliance:
    frameworks_affected:
      - PCI-DSS
      - SOC2
      - HIPAA
    regulatory_impact: critical

This request would produce confidence: 1.0 (all dimensions fully covered) and a score in the upper critical range.

Listing Signals at Runtime¶

You can inspect the full signal catalog at any time using the CLI:

ores signals

NAME          DESCRIPTION                                                               FIELDS
----          -----------                                                               ------
asset         Asset criticality, network exposure, and data classification context      criticality, network_exposure, data_classification
blast_radius  Blast radius: number of affected systems and lateral movement potential    affected_systems, lateral_movement_possible
compliance    Compliance frameworks affected and regulatory impact severity              frameworks_affected, regulatory_impact
cvss          Common Vulnerability Scoring System score and vector string                base_score, vector
epss          Exploit Prediction Scoring System probability and percentile               probability, percentile
nist          NIST severity classification and optional CWE identifier                   severity, cwe
patch         Patch availability, age, and compensating control status                   patch_available, patch_age_days, compensating_control
threat_intel  Threat intelligence: active exploitation and ransomware association        actively_exploited, ransomware_associated