VRM Interfaces
Working with InterfacesWorking with InterfacesVRM Interfaces
The Vulnerability Response Management (VRM) interfaces define the input and output schemas used by connectors and actions in vulnerability management workflows. These interfaces standardize how vulnerability findings are ingested, enriched, tracked, and remediated across Turbine playbooks.
For general information about what interfaces are and how to use them, see .
Note: For complete data model field definitions, see Turbine Schema Reference (VRM)Turbine Schema Reference (VRM). For additional external documentation, see Vulnerability Finding Data Model and ITSM Response Data Model.
Vulnerability Finding to Vulnerability Finding v1.0.0
Purpose: Converts vulnerability finding objects while preserving all vulnerability data. Used for vulnerability data normalization and processing.
Input schema:
Field | Type | Required | Description |
|---|---|---|---|
vulnerability_finding | object | Yes | Vulnerability finding object |
vulnerability_finding.vulnerability-id | string | No | CVE or vulnerability identifier |
vulnerability_finding.vulnerability-description | string | No | Description of the vulnerability |
vulnerability_finding.vulnerability-status | string | No | Current status |
vulnerability_finding.vulnerability-published-date | string | No | Publication date |
vulnerability_finding.vulnerability-last-modified-date | string | No | Last modification date |
vulnerability_finding.vulnerability-cvss-base-score | integer | No | CVSS base score |
vulnerability_finding.vulnerability-cvss-version | string | No | CVSS version |
vulnerability_finding.vulnerability-cvss-vector-string | string | No | CVSS vector string |
vulnerability_finding.vulnerability-cvss-temporal-threat-score | integer | No | Temporal or threat score |
vulnerability_finding.vulnerability-epss-score | integer | No | EPSS score |
vulnerability_finding.vulnerability-epss-percentile | integer | No | EPSS percentile |
vulnerability_finding.vulnerability-references | string | No | Reference links |
vulnerability_finding.vulnerability-weaknesses-(cwes) | string | No | CWE identifiers |
vulnerability_finding.vulnerability-related-attack-patterns | string | No | Related attack patterns |
vulnerability_finding.vulnerability-exploits | string | No | Exploit information |
vulnerability_finding.vulnerability-public-exploit-found | string | No | Public exploit flag |
vulnerability_finding.vulnerability-commercial-exploit-found | string | No | Commercial exploit flag |
vulnerability_finding.vulnerability-weaponized-exploit-found | string | No | Weaponized exploit flag |
vulnerability_finding.vulnerability-reported-exploited | string | No | Reported exploitation flag |
vulnerability_finding.vulnerability-reported-exploitation | string | No | Exploitation details |
vulnerability_finding.vulnerability-reported-exploited-by-threat-actors | string | No | Threat actor exploitation |
vulnerability_finding.vulnerability-reported-exploited-by-ransomware | string | No | Ransomware exploitation |
vulnerability_finding.vulnerability-reported-exploited-by-botnets | string | No | Botnet exploitation |
vulnerability_finding.vulnerability-exploits-trending-on-github | string | No | GitHub trending flag |
vulnerability_finding.vulnerability-first-exploit-published | string | No | First exploit publication date |
vulnerability_finding.vulnerability-max-exploit-maturity | string | No | Maximum exploit maturity |
vulnerability_finding.vulnerability-in-known-exploited-vulnerabilities | string | No | KEV list flag |
vulnerability_finding.vulnerability-finding-unique-id | string | No | Unique finding identifier |
vulnerability_finding.vulnerability-finding-grouping-id | string | No | Grouping identifier |
vulnerability_finding.vulnerability-finding-summary | string | No | Finding summary |
vulnerability_finding.vulnerability-finding-primary-asset-identifier | string | No | Primary asset ID |
vulnerability_finding.vulnerability-finding-primary-asset-type | string | No | Primary asset type |
vulnerability_finding.vulnerability-finding-hostnames | array of strings | No | Affected hostnames |
vulnerability_finding.vulnerability-finding-ip-addresses | array of strings | No | Affected IP addresses |
vulnerability_finding.vulnerability-finding-mac-addresses | array of strings | No | Affected MAC addresses |
vulnerability_finding.vulnerability-finding-sources | array of strings | No | Finding sources |
vulnerability_finding.vulnerability-finding-scan-id | string | No | Scan identifier |
vulnerability_finding.vulnerability-finding-scan-type | string | No | Scan type |
vulnerability_finding.vulnerability-finding-raw-risk-score | integer | No | Raw risk score |
vulnerability_finding.vulnerability-finding-turbine-risk-score | integer | No | Turbine risk score |
vulnerability_finding.vulnerability-finding-remediation-status | string | No | Remediation status |
vulnerability_finding.vulnerability-finding-remediation | string | No | Remediation details |
vulnerability_finding.vulnerability-finding-remediation-owner | string | No | Remediation owner |
vulnerability_finding.vulnerability-finding-exception-reference | array of strings | No | Exception references |
vulnerability_finding.vulnerability-finding-exception-reason | string | No | Exception reason |
vulnerability_finding.vulnerability-finding-last-ingested | string | No | Last ingestion timestamp |
vulnerability_finding.vulnerability-finding-last-enriched | string | No | Last enrichment timestamp |
vulnerability_finding.vulnerability-finding-raw-json | string | No | Raw JSON data |
vulnerability_finding.asset-reference | array of strings | No | Asset references |
vulnerability_finding.asset-zone | string | No | Asset zone |
vulnerability_finding.merged-risk-scores | string | No | Merged risk score information |
vulnerability_finding.vulnerability-finding-mitre-attack-techniques | string | No | MITRE ATT&CK techniques |
Output schema:
Field | Type | Required | Description |
|---|---|---|---|
vulnerability_finding | object | No | Transformed vulnerability finding with same structure |
Use cases:
- Vulnerability data normalization
- Vulnerability finding processing
- Vulnerability data transformation
- Cross-platform vulnerability data exchange
Enriched Vulnerability Finding to Enriched Vulnerability Finding v1.0.0
Purpose: Converts enriched vulnerability finding objects with additional threat intelligence and context data.
Input schema:
Field | Type | Required | Description |
|---|---|---|---|
enriched_vulnerability_finding | object | No | Enriched vulnerability finding object |
Output schema:
Field | Type | Required | Description |
|---|---|---|---|
enriched_vulnerability_finding | object | No | Transformed enriched finding |
Use cases:
- Enriched vulnerability processing
- Threat intelligence integration
- Vulnerability enrichment workflows
Array of Object to Array of Vulnerability Finding v1.0.0
Purpose: Converts an array of generic objects into an array of standardized vulnerability finding objects.
Input schema:
Field | Type | Required | Description |
|---|---|---|---|
objects | array of objects | No | Array of generic objects |
Output schema:
Field | Type | Required | Description |
|---|---|---|---|
vulnerability_findings | array of objects | No | Array of standardized vulnerability finding objects |
Use cases:
- Bulk vulnerability ingestion
- Vulnerability data normalization
- Multi-source vulnerability aggregation
Asset to Tracking ID v1.0.0
Purpose: Extracts or generates tracking identifiers from asset objects.
Input schema:
Field | Type | Required | Description |
|---|---|---|---|
asset | object | No | Asset object |
Output schema:
Field | Type | Required | Description |
|---|---|---|---|
tracking_id | string | No | Tracking identifier for the asset |
Use cases:
- Asset tracking
- Asset identification
- Asset management workflows
Remediation Item to Ticket v1.0.0
Purpose: Creates or updates tickets in ITSM systems based on remediation item data.
Input schema:
Field | Type | Required | Description |
|---|---|---|---|
remediation_owner | string | Yes | Party responsible for remediation |
remediation_channel | string | Yes | Channel to reach remediation owner |
remediation_item_tracking_id | string | Yes | Tracking ID of remediation item |
outbound_message | string | Yes | Message to attach to ticket |
Output schema:
Field | Type | Required | Description |
|---|---|---|---|
ticket_id | string | No | Ticket ID from ITSM system |
ticket_status | string | No | Ticket status (Open, Closed, Error) |
ticket_opened | string | No | Timestamp when ticket was opened |
ticket_status_updated | string | No | Timestamp of last status update |
ticket_status_message | string | No | Status message about ticket creation |
Use cases:
- ITSM integration
- Remediation workflow automation
- Ticket creation from vulnerability findings
- Remediation tracking
Remediation Item Check v1.0.0
Purpose: Checks the status of remediation items and associated ITSM tickets.
Input schema:
Field | Type | Required | Description |
|---|---|---|---|
remediation_owner | string | Yes | Remediation owner identifier |
remediation_channel | string | Yes | Remediation channel |
remediation_item_tracking_id | string | Yes | Tracking ID of remediation item |
itsm_ticket_id | string | Yes | ITSM ticket ID to check |
Output schema:
Field | Type | Required | Description |
|---|---|---|---|
ticket_status | string | No | Current ticket status |
ticket_status_updated | string | No | Timestamp of last status check or update |
inbound_messages | string | No | Replies or inbound messages from ITSM |
Use cases:
- Remediation status monitoring
- Ticket status synchronization
- Remediation workflow tracking
- ITSM integration status checks