Skip to content

Look Something Up

This page is for a reader who has been here before and wants one page in particular. It lists the pages you look things up in, from every tab of the site, in the order the tabs are in. Each entry links the page and gives its own summary. A set of related pages, such as the parts of the Protocol Specification, is one entry that links the page that opens the set.

If this is your first visit, start from the home page instead: it sends you to the reading path for what you came to do.

How Vultron Works

  • Concept Taxonomy — Reference definitions for the distinct concepts that together constitute Vultron. Use this document to understand what each named concept covers, what it excludes, and how the concepts relate to each other.
  • Glossary — The terms this documentation uses for the Vultron Coordinated Vulnerability Disclosure (CVD) protocol and its reference implementation, with the aliases to avoid and the ambiguities to watch for.
  • Documentation Conventions — The call-out boxes this documentation uses, and how to tell a normative page from an informative one.

Coordinate Cases

  • Standards Crosswalks — Crosswalks of the Vultron Protocol against the International Organization for Standardization (ISO) standards on vulnerability handling and disclosure, against Stakeholder-Specific Vulnerability Categorization (SSVC), and against the Common Security Advisory Framework (CSAF) 2.1 draft, each routed to the explanation that covers it and to the specification section that governs it.

Implement the Protocol

  • Protocol Specification — The Vultron Protocol specification: its messages, their encoding and transport, and the state machines participants use to track a shared case.
  • Messages — How the formal message set relates to the ActivityStreams 2.0 (AS2) wire vocabulary the prototype sends and receives.
  • Protocol Quick Reference — A single-page summary of the protocol's state machines, message types, and how they interact.
  • Conformance Matrix — Which capability sets each Vultron role requires, which transitions each role may drive, and the named configurations a conformance claim can use, as tables checked against the specification.
  • Formal Protocol — The Multi-Party Coordinated Vulnerability Disclosure (MPCVD) process defined as a communicating hierarchical state machine.
  • Vultron AS Objects — The Vultron ActivityStreams objects that extend the ActivityStreams vocabulary.

Reference Implementation

  • rv Demo Protocol Trace — The message-level protocol trace of the Reporter + Vendor (rv) demo: every ActivityStreams activity exchanged, the trigger that causes it, and the case ledger entries it produces.
  • Demo Scenarios — One narrative page for each multi-actor demo scenario, which tells the case that scenario runs from the participants' point of view.
  • Trigger API — The POST /actors/{actor_id}/trigger/{behavior} endpoints, each of which starts a protocol behavior on an actor's behalf.
  • Case Model Fields — The fields of the case, participant, and status objects, as the reference implementation defines them.
  • Node Configuration — The settings a Vultron reference implementation node reads from config.yaml and VULTRON_* environment variables, generated from the configuration model.
  • Architecture — The architecture requirements of the reference implementation: structure that carries over to other languages but that Vultron compliance does not require.
  • User Stories — Requirements captured as user stories.

Project

  • Versioning — The release versioning scheme for the Vultron repository.
  • What's New — The documentation pages added in the last 90 days.
  • License — The license terms under which Vultron is distributed.
  • Acknowledgments — The prior works Vultron builds on, and the funding that supports it.