Refactor namespaces #791

ahouseholder · 2025-06-16T20:00:20Z

Resolves Make OutcomeGroups interchangeable with DecisionPoints #745
Resolves Organize data and python modules by namespace #751
Resolves Some decision points missing in data/json/ folder #754
Resolves Consider versioning Outcomes like Decision Points #454
Prepares the way for resolution of We need a DecisionTable object #592 in a future PR.

This PR refactors the python module layout so that namespaced objects are organized by namespace (pushing ssvc namespace objects into their own directory so they are peers to other namespaces like cisa etc.). This results in a lot of files being renamed and a lot of python import statement changes. Some other incidental changes are also included.

Sorry the PR is so large, it was not possible to do the refactoring without touching a lot of files.

CoPilot Summary

This pull request includes updates to documentation and JSON files to improve clarity and consistency in terminology. The changes primarily involve replacing "no" with "negligible" in descriptions and updating testing instructions in the README.md file.

Documentation Updates:

README.md: Updated testing instructions to clarify that tests run in the host OS, and removed references to Docker.

Terminology Consistency in JSON Files:

data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_1_0_0.json: Replaced "no impact" with "negligible impact" in the description of availability impact.
data/json/decision_points/cvss/modified_confidentiality_impact_to_the_subsequent_system_1_0_0.json: Replaced "no loss of confidentiality" with "negligible loss of confidentiality" in the description of confidentiality impact.
data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_1_0_0.json: Replaced "no loss of integrity" with "negligible loss of integrity" in the description of integrity impact.

…roup` make it easier to build decision frameworks

…2-we-need-a-policy-object

… to adjust default json output key order

Prepares for future ability to convert from OutcomeGroup to DecisionPoint

…need-a-policy-object

sei-vsarvepalli · 2025-06-17T18:36:56Z

Some duplicate keys found:

ssvc/decision_points/ssvc_/supplier_contacted.py:    key="SC",
ssvc/decision_points/ssvc_/supplier_cardinality.py:    key="SC",

ssvc/decision_points/ssvc_/supplier_involvement.py:    key="SI",
ssvc/decision_points/ssvc_/safety_impact.py:    key="SI",

ssvc/decision_points/cvss/scope.py:    key="S",
ssvc/decision_points/cvss/supplemental/safety.py:    key="S",

sei-vsarvepalli · 2025-06-17T19:27:29Z

There are a few strange json files, for example these 5 files for integrity requirements under CVSS.

data/json/decision_points/cvss/integrity_requirement_1_0_0.json
data/json/decision_points/cvss/integrity_requirement_1_0_1.json
data/json/decision_points/cvss/integrity_requirement_1_0_1.json
data/json/decision_points/cvss/integrity_requirement_1_1_0.json
data/json/decision_points/cvss/integrity_requirement_1_1_1.json

There are only three defined in src/ssvc/decision_points/cvss/integrity_requirement.py

INTEGRITY_REQUIREMENT_1 = CvssDecisionPoint(
    name="Integrity Requirement",
    description="This metric measures the impact to the integrity of a successfully exploited vulnerability.",
    key="IR",
    version="1.0.0",
    values=(
        _LOW,
        _MEDIUM,
        _HIGH,
        NOT_DEFINED_ND,
    ),
)

INTEGRITY_REQUIREMENT_1_1 = CvssDecisionPoint(
    name="Integrity Requirement",
    description="This metric measures the impact to the integrity of a successfully exploited vulnerability.",
    key="IR",
    version="1.1.0",
    values=(
        _LOW,
        _MEDIUM,
        _HIGH,
        NOT_DEFINED_X,
    ),
)

INTEGRITY_REQUIREMENT_1_1_1 = CvssDecisionPoint(
    name="Integrity Requirement",
    description="This metric enables the consumer to customize the assessment depending on the importance of the "
    "affected IT asset to the analyst’s organization, measured in terms of Confidentiality.",
    key="IR",
    version="1.1.1",
    values=(
        _LOW_2,
        _MEDIUM_2,
        _HIGH_2,
        NOT_DEFINED_X,
    ),
)

VERSIONS = (
    INTEGRITY_REQUIREMENT_1,
    INTEGRITY_REQUIREMENT_1_1,
    INTEGRITY_REQUIREMENT_1_1_1,
)

If you have way you are iterating through all the decision points, can you share it? We can completely remove data/json/decision_points folder and start over. The modified may be another one to be concerned about which provide 23 with the "Not Defined" keyword added to the CVSS decision points as a decision point value.

fixing mission prevalence imports.

…amespaces

…/SSVC into refactor_namespaces

ahouseholder · 2025-06-18T18:32:20Z

@sei-vsarvepalli I think I've fixed the problems you found.

New makefile target make regenerate_json added so it's reproducible
Fixed up doctools.py so it's walking directories for python modules

sei-vsarvepalli · 2025-06-18T19:04:31Z

@sei-vsarvepalli I think I've fixed the problems you found.

New makefile target make regenerate_json added so it's reproducible

Fixed up doctools.py so it's walking directories for python modules

Still some issues.. The files should be generated under data/json/outcomes folder.

data/json/decision_points/x_community/theparanoids_1_0_0.json
data/json/decision_points/x_basic/yes_no_1_0_0.json
data/json/decision_points/x_basic/moscow_1_0_0.json
data/json/decision_points/x_basic/value_complexity_1_0_0.json
data/json/decision_points/x_basic/do_schedule_delegate_delete_1_0_0.json
data/json/decision_points/cisa/cisa_levels_1_0_0.json

The file src/ssvc/decision_points/ssvc/mission_prevalence.py still has

from ssvc.decision_points.ssvc_.base import SsvcDecisionPoint

We can probably delete the whole mission_prevalence.py looks like it is not used anymore anywhere. The old Mission Prevalence may be gone now?

…e only place it was ever used)

ahouseholder · 2025-06-18T19:15:30Z

So the outcome groups are now decision point objects (which lets them be used as inputs to downstream decisions). Their appearance in the decision_point json dirs was intentional. This is how we can deal with "compound decision points" too.

flowchart TB

subgraph cdp[Compound Decision Point]
A
B
C
D
end

A --> D
B --> D
C --> D

D --> G
E --> G
F --> G

Mission Prevalence only ever showed up in CISA's model, so I just fixed it and moved it to the CISA namespace. I don't want to start deleting things that were used previously though, so I think it's okay to keep it for now.

sei-vsarvepalli

Looks good now.

src/ssvc/decision_points/ssvc_/supplier_cardinality.py

ahouseholder added 30 commits February 25, 2025 10:43

add __str__() method to SsvcDecisionPointValue

a096d15

add combinations and combo_strings methods to `SsvcDecisionPointG…

b753aed

…roup` make it easier to build decision frameworks

wip commit

5a50e8a

Merge branch 'main' of https://github.com/CERTCC/SSVC into feature/59…

0727a06

…2-we-need-a-policy-object

Merge branch 'main' of https://github.com/CERTCC/SSVC into feature/59…

9266736

…2-we-need-a-policy-object

fix type hint on SsvcDecisionPointGroup object

e1de818

add VERSIONS and LATEST pattern to decision point groups

6f9fae7

add keys to outcome groups

d953c6a

refactor DecisionFramework for testability

e8c94dd

replace list with tuple to match type hint

e0af9c2

black reformat

85af209

add validator method to check mapping

1139ca0

refactor

f51b3f2

fixup type hints

3cc382c

add test

af28a08

rename DecisionFramework to PrioritizationFramework

34632e8

rename new class to DecisionTable

57fb8a6

create a _Valued mixin

aa5040f

add _Valued mixin to base decision point class. Also reorder mixins…

f46b420

… to adjust default json output key order

update json examples to reflect new base class mixin ordering

03d103a

Merge branch 'main' into feature/592-we-need-a-policy-object

b985425

empty the ssvc/decision_tables/__init__.py

7fe39a3

rename OutcomeGroup.outcomes to OutcomeGroup.values

b31e7d7

Prepares for future ability to convert from OutcomeGroup to DecisionPoint

Merge branch 'feature/reorder-base-class-mixins' into feature/592-we-…

b977e20

…need-a-policy-object

add len() to _Valued mixin

b720435

use _Valued mixin

71c9003

add len() to _Valued mixin

5b03c6a

Merge branch 'feature/reorder-base-class-mixins' into feature/592-we-…

469bbae

…need-a-policy-object

add tests

66e8410

add tests

c496db4

ahouseholder requested a review from j--- as a code owner June 16, 2025 20:00

ahouseholder added the python Pull requests that update Python code label Jun 16, 2025

Merge branch 'main' into refactor_namespaces

88fe089

ahouseholder and others added 11 commits June 17, 2025 15:39

update Makefile

c37c036

Update mission_prevalence.py

5343403

fixing mission prevalence imports.

rename packages (*.ssvc_ -> *.ssvc)

bddc0f8

make registry fail on duplicate item keys

df69a40

fix duplicate keys

f7e6a2a

regenerate json examples

43f551b

Merge branch 'main' of https://github.com/CERTCC/SSVC into refactor_n…

2dbe54b

…amespaces

Merge branch 'refactor_namespaces' of https://github.com/ahouseholder…

64d33ff

…/SSVC into refactor_namespaces

add makefile target to regenerate json examples

13a6072

fix unit tests

c726d78

add test for registry duplicates

2e56050

move mission prevalence to cisa namespace (their customization was th…

71ae526

…e only place it was ever used)

sei-vsarvepalli approved these changes Jun 23, 2025

View reviewed changes

src/ssvc/decision_points/ssvc_/supplier_cardinality.py Outdated Show resolved Hide resolved

ahouseholder merged commit 398963a into CERTCC:main Jun 23, 2025
2 checks passed

ahouseholder added tech/backend Back-end tools, code, infrastructure tech/data Data implementation (content of /data, data object instances, etc.) and removed tech/environment Project environment, deployment, CI, etc. labels Jul 1, 2025

ahouseholder mentioned this pull request Jul 1, 2025

Consider versioning Outcomes like Decision Points #454

Closed

ahouseholder mentioned this pull request Jul 29, 2025

Initial Decision Table object #795

Merged

ahouseholder deleted the refactor_namespaces branch August 7, 2025 17:49

ahouseholder mentioned this pull request Aug 13, 2025

Make OutcomeGroups interchangeable with DecisionPoints #745

Closed

ahouseholder added this to the 2025-09 milestone Aug 21, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Refactor namespaces #791

Refactor namespaces #791

Uh oh!

ahouseholder commented Jun 16, 2025 •

edited

Loading

Uh oh!

sei-vsarvepalli commented Jun 17, 2025

Uh oh!

sei-vsarvepalli commented Jun 17, 2025

Uh oh!

ahouseholder commented Jun 18, 2025

Uh oh!

sei-vsarvepalli commented Jun 18, 2025

Uh oh!

ahouseholder commented Jun 18, 2025 •

edited

Loading

Uh oh!

sei-vsarvepalli left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Refactor namespaces #791

Refactor namespaces #791

Uh oh!

Conversation

ahouseholder commented Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CoPilot Summary

Documentation Updates:

Terminology Consistency in JSON Files:

Uh oh!

sei-vsarvepalli commented Jun 17, 2025

Uh oh!

sei-vsarvepalli commented Jun 17, 2025

Uh oh!

ahouseholder commented Jun 18, 2025

Uh oh!

sei-vsarvepalli commented Jun 18, 2025

Uh oh!

ahouseholder commented Jun 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sei-vsarvepalli left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ahouseholder commented Jun 16, 2025 •

edited

Loading

ahouseholder commented Jun 18, 2025 •

edited

Loading