Skip to main content

Finding Schema

Cloudaware represents each vulnerability as one or more Cloudaware Vulnerability Scan records. While fields vary slightly by source, the core schema is consistent so you can query and report across scanners.

Use this guide to learn about the Cloudaware Vulnerability Scan record structure, including identifiers, asset links, risk fields, and lifecycle status.

Cloudaware Vulnerability Scan​

The Cloudaware Vulnerability Scan object is the CMDB CI type that stores vulnerability scan findings, and its API name is CA10__CaNessusVulnerability__c. The object uses multiple record types to distinguish scan data sources, and each may use a different primary relationship field specific to the integration.

Core Identifiers​

  • Name/Id – Salesforce identifiers and human‑readable name for the finding.
  • Record Type – Distinguishes the source (e.g., cloud‑native, Qualys, Rapid7, Tenable, Snyk, etc).
  • Source/Scanner fields – Vendor‑specific identifiers such as scanner asset IDs, plugin IDs, or rule IDs.
  • Cloudaware UUID – Internal unique identifier used by CMDB for correlation and deduplication.

Vulnerability Details​

  • CVE/Identifier fields – CVE IDs or other vulnerability identifiers (e.g., advisory IDs).
  • Description – Long description of the issue.
  • Category/Type – Classification such as OS, package, configuration, web, container, code, etc.
  • Package/Component/Resource – Affected package name, version, or resource path where provided.
  • Asset lookups – References to one or more CMDB CIs:
    • Servers/instances (AWS EC2, Azure VMs, GCE, physical servers).
    • Containers and container images.
    • Network devices.
    • Cloud PaaS services where applicable.
  • Environment – Production vs non‑production, region, and other environment attributes (typically via related CI or tag).
  • Application/Service – Owning application or service (typically via related CI).
  • Organization Unit (OU)/Team – Primary owner for routing and escalation (typically via related CI).

Severity and Risk​

  • Vendor severity – Raw severity from the scanner (e.g., Critical/High/Medium/Low).
  • CVSS metrics – Base scores and vectors when provided.
  • Cloudaware risk fields – Derived risk scores or ExPRT‑style ratings used in prioritization.

See Severity & Scoring for more detail.

Lifecycle and Status​

  • First Seen/Last Seen – When the vulnerability was first detected and most recently observed.
  • Disappearance Time – When the scanner last confirmed that the vulnerability was no longer present.
  • Status/State – Open, remediated, suppressed, or other internal workflow states.
  • Is Remediated – Indicates that a vulnerability finding was remediated (within a remediation task or initiative).
  • Is Suppressed – Indicates that an active vulnerability exception exists for this finding.

These fields are used to drive SLAs, exception handling, and escalation. See Ownership & Routing for how they tie into workflows and ticketing.