How-to Guides
This page is not normative
This page is not considered a core part of the Vultron Protocol as proposed in the main documentation. Although within the page we might provide guidance in terms of SHOULD, MUST, etc., the content here is not normative.
This section collects guidance for potential implementations of Vultron, and for the programs preparing to coordinate through it.
A complete protocol implementation specification remains a work in progress; a few additional suggestions for potential implementers follow.
Prerequisites
The How-to Guides section assumes that you have:
- an interest in implementing the Vultron Protocol
- basic familiarity with the Vultron Protocol
- familiarity with the Coordinated Vulnerability Disclosure (CVD) process in general
If you are unfamiliar with the Vultron Protocol, start with Explanation. For technical reference, see Reference. If you're just trying to understand the CVD process, start with the CERT Guide to Coordinated Vulnerability Disclosure.
In this section, you will find:
- Adopt Vultron in Your CVD Program — Take a Coordinated Vulnerability Disclosure program from its current practice to one that can coordinate cases through Vultron: name your roles, choose a conformance claim, map your intake to the report states, publish your embargo defaults, and decide which judgment calls stay yours.
- Measuring Your CVD Program — Score your own program's closed cases against the chance baseline from the Measuring CVD research, and read the result as a skill indicator you can act on.
- Process Implementation — Where an existing ticketing, embargo, or threat-monitoring workflow emits Vultron messages, milestone by milestone.
- Vultron ActivityPub — The shape of a Vultron activity on the wire: ActivityStreams 2.0 verbs, Vultron objects, and the fields a receiver reads to tell activities apart.
- Wiring a Capability — Wire a capability into the reference implementation, replacing a call-out stub with real backend logic.
This section will expand over time to include:
- Basic data model examples
- Behavior logic implementation examples
- Simulation examples
- Communication protocol implementation examples
- Other implementation notes as needed
The Vultron Protocol is an interoperability protocol
The protocol and data structures outlined in this documentation are intended to facilitate interoperability among individual organizations' workflow management systems. As such, they are focused on the exchange of information and data necessary for the Multi-Party CVD (MPCVD) process to function and will not likely be sufficient to fully address any individual organization's vulnerability response process.
Reading path: You maintain a vulnerability tracker and want it to talk to your partners
This page is part of Build against the contract.
Before this page: