{
  "$id": "ai-safety-lab incident db",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "tables": {
    "actor": {
      "properties": {
        "first_seen": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "kind": {
          "enum": [
            "handle",
            "ip",
            "ip16",
            "asn",
            "model",
            "developer",
            "human",
            "tracker"
          ]
        },
        "last_seen": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "notes": {
          "type": "string"
        },
        "venue_id": {
          "type": "string"
        }
      },
      "required": [
        "kind",
        "name",
        "notes"
      ],
      "type": "object"
    },
    "actor_link": {
      "properties": {
        "basis": {
          "enum": [
            "observed",
            "self-described",
            "inferred",
            "reported",
            "developer-disclosure",
            "self-identified-handle",
            "cloud-asn-match",
            "task-content-match",
            "timing-match",
            "cross-site-handle-reuse"
          ]
        },
        "evidence_id": {
          "type": "string"
        },
        "from_actor": {
          "type": "string"
        },
        "kind": {
          "enum": [
            "used-ip",
            "claims-model",
            "same-as",
            "operated-by"
          ]
        },
        "to_actor": {
          "type": "string"
        }
      },
      "required": [
        "from_actor",
        "to_actor",
        "kind",
        "basis"
      ],
      "type": "object"
    },
    "alias": {
      "properties": {
        "ours": {
          "type": "string"
        },
        "table_name": {
          "type": "string"
        },
        "theirs": {
          "type": "string"
        },
        "tracker_id": {
          "type": "string"
        }
      },
      "required": [
        "ours",
        "table_name",
        "tracker_id",
        "theirs"
      ],
      "type": "object"
    },
    "campaign": {
      "properties": {
        "basis": {
          "type": "array"
        },
        "catch_all": {
          "type": "integer"
        },
        "cohesion": {
          "enum": [
            "established",
            "probable",
            "assessed",
            "unknown"
          ]
        },
        "cohesion_basis": {
          "type": "string"
        },
        "confidence": {
          "enum": [
            "confirmed",
            "likely",
            "possible",
            "unattributed"
          ]
        },
        "developer": {
          "type": "string"
        },
        "evidence_id": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "models": {
          "type": "array"
        },
        "name": {
          "type": "string"
        },
        "period_end": {
          "type": "string"
        },
        "period_start": {
          "type": "string"
        },
        "related": {
          "type": "array"
        },
        "summary": {
          "type": "string"
        }
      },
      "required": [
        "name",
        "summary",
        "models",
        "confidence",
        "basis",
        "catch_all",
        "related"
      ],
      "type": "object"
    },
    "category": {
      "properties": {
        "definition": {
          "type": "string"
        },
        "examples": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      },
      "required": [
        "name",
        "definition",
        "examples"
      ],
      "type": "object"
    },
    "claim": {
      "properties": {
        "basis": {
          "type": "string"
        },
        "checked_by": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "made_by": {
          "type": "string"
        },
        "notes": {
          "type": "string"
        },
        "status": {
          "enum": [
            "verified",
            "inferred",
            "reported",
            "contradicted"
          ]
        },
        "subject_id": {
          "type": "string"
        },
        "subject_kind": {
          "enum": [
            "incident",
            "campaign",
            "cluster",
            "venue",
            "actor",
            "record",
            "edge"
          ]
        },
        "text": {
          "type": "string"
        }
      },
      "required": [
        "subject_kind",
        "subject_id",
        "text",
        "status",
        "notes"
      ],
      "type": "object"
    },
    "cluster": {
      "properties": {
        "body_markers": {
          "type": "array"
        },
        "campaign_id": {
          "type": "string"
        },
        "datasets": {
          "type": "array"
        },
        "id": {
          "type": "string"
        },
        "markers": {
          "type": "array"
        },
        "name": {
          "type": "string"
        },
        "summary": {
          "type": "string"
        }
      },
      "required": [
        "name",
        "summary",
        "datasets",
        "markers",
        "body_markers"
      ],
      "type": "object"
    },
    "collection": {
      "properties": {
        "at": {
          "type": "string"
        },
        "files": {
          "type": "array"
        },
        "id": {
          "type": "string"
        },
        "model": {
          "type": "string"
        },
        "notes": {
          "type": "string"
        },
        "sha256": {
          "type": "object"
        },
        "target": {
          "type": "string"
        },
        "tool": {
          "type": "string"
        },
        "user_agent": {
          "type": "string"
        }
      },
      "required": [
        "at",
        "tool",
        "target",
        "files",
        "sha256",
        "notes"
      ],
      "type": "object"
    },
    "defence": {
      "properties": {
        "acted_on": {
          "enum": [
            "yes",
            "late",
            "no",
            "unknown",
            "n/a"
          ]
        },
        "configured": {
          "enum": [
            "yes",
            "partly",
            "no",
            "unknown"
          ]
        },
        "evidence_id": {
          "type": "string"
        },
        "existed": {
          "enum": [
            "yes",
            "no",
            "unknown"
          ]
        },
        "fired": {
          "enum": [
            "yes",
            "no",
            "unknown",
            "n/a"
          ]
        },
        "incident_id": {
          "type": "string"
        },
        "layer": {
          "enum": [
            "egress-allowlist",
            "sandbox-isolation",
            "shared-service-isolation",
            "flow-monitoring",
            "alert-routing",
            "on-call",
            "admission-policy",
            "eval-hygiene",
            "output-classifiers",
            "transcript-integrity",
            "venue-moderation",
            "rate-limit",
            "identity"
          ]
        },
        "notes": {
          "type": "string"
        }
      },
      "required": [
        "incident_id",
        "layer",
        "existed",
        "notes"
      ],
      "type": "object"
    },
    "edge": {
      "properties": {
        "basis": {
          "enum": [
            "structural",
            "textual",
            "inferred"
          ]
        },
        "evidence_id": {
          "type": "string"
        },
        "from_record": {
          "type": "string"
        },
        "kind": {
          "enum": [
            "reply",
            "revert",
            "restore",
            "relay",
            "announce",
            "chunk-of",
            "same-body",
            "deletes",
            "quotes",
            "logs"
          ]
        },
        "ord": {
          "type": "integer"
        },
        "to_record": {
          "type": "string"
        }
      },
      "required": [
        "from_record",
        "to_record",
        "kind",
        "basis"
      ],
      "type": "object"
    },
    "evidence": {
      "properties": {
        "collection_id": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "kind": {
          "enum": [
            "primary",
            "report",
            "press",
            "secondary",
            "agent-authored"
          ]
        },
        "model": {
          "type": "string"
        },
        "path": {
          "type": "string"
        },
        "published": {
          "type": "string"
        },
        "publisher": {
          "type": "string"
        },
        "retrieved_at": {
          "type": "string"
        },
        "retrieved_by": {
          "type": "string"
        },
        "sha256": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "tracker_id": {
          "type": "string"
        },
        "url": {
          "type": "string"
        }
      },
      "required": [
        "kind"
      ],
      "type": "object"
    },
    "figure": {
      "properties": {
        "counts": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "source": {
          "type": "string"
        },
        "subject_id": {
          "type": "string"
        },
        "subject_kind": {
          "type": "string"
        },
        "value": {
          "type": "string"
        },
        "what": {
          "type": "string"
        }
      },
      "required": [
        "value",
        "what"
      ],
      "type": "object"
    },
    "finding": {
      "properties": {
        "basis": {
          "type": "string"
        },
        "evidence_id": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "incident_id": {
          "type": "string"
        },
        "status": {
          "enum": [
            "assessed",
            "probable",
            "established"
          ]
        },
        "text": {
          "type": "string"
        }
      },
      "required": [
        "incident_id",
        "text",
        "status",
        "basis"
      ],
      "type": "object"
    },
    "incident": {
      "properties": {
        "campaigns": {
          "type": "array"
        },
        "categories": {
          "type": "array"
        },
        "contained": {
          "type": "string"
        },
        "contained_basis": {
          "enum": [
            "known",
            "estimated",
            "unknown"
          ]
        },
        "developers": {
          "type": "array"
        },
        "disclosed_by": {
          "type": "string"
        },
        "disclosed_on": {
          "type": "string"
        },
        "discovered": {
          "type": "string"
        },
        "discovered_basis": {
          "enum": [
            "known",
            "estimated",
            "unknown"
          ]
        },
        "discovered_by": {
          "enum": [
            "operator",
            "venue-owner",
            "third-party",
            "victim",
            "agent",
            "press"
          ]
        },
        "evidence_id": {
          "type": "string"
        },
        "first_action": {
          "type": "string"
        },
        "first_action_basis": {
          "enum": [
            "known",
            "estimated",
            "unknown"
          ]
        },
        "first_compromise": {
          "type": "string"
        },
        "first_compromise_basis": {
          "enum": [
            "known",
            "estimated",
            "unknown"
          ]
        },
        "first_exfil": {
          "type": "string"
        },
        "first_exfil_basis": {
          "enum": [
            "known",
            "estimated",
            "unknown"
          ]
        },
        "id": {
          "type": "string"
        },
        "models": {
          "type": "array"
        },
        "name": {
          "type": "string"
        },
        "period_end": {
          "type": "string"
        },
        "period_start": {
          "type": "string"
        },
        "related": {
          "type": "array"
        },
        "report_stage": {
          "enum": [
            "preliminary",
            "interim",
            "final"
          ]
        },
        "severity": {
          "enum": [
            "nuisance",
            "exposure",
            "intrusion",
            "breach",
            "harm"
          ]
        },
        "status": {
          "enum": [
            "confirmed",
            "attributed",
            "candidate"
          ]
        },
        "summary": {
          "type": "string"
        }
      },
      "required": [
        "name",
        "developers",
        "models",
        "status",
        "summary",
        "campaigns",
        "related",
        "categories"
      ],
      "type": "object"
    },
    "lead": {
      "properties": {
        "context": {
          "type": "string"
        },
        "discovered_at": {
          "type": "string"
        },
        "host": {
          "type": "string"
        },
        "reason": {
          "type": "string"
        },
        "source_name": {
          "type": "string"
        },
        "source_url": {
          "type": "string"
        },
        "status": {
          "enum": [
            "candidate",
            "fetched",
            "promoted",
            "rejected"
          ]
        },
        "url": {
          "type": "string"
        }
      },
      "required": [
        "status"
      ],
      "type": "object"
    },
    "payload": {
      "properties": {
        "charset": {
          "type": "string"
        },
        "cleared": {
          "type": "integer"
        },
        "decoded": {
          "type": "integer"
        },
        "entropy": {
          "type": "number"
        },
        "head_hex": {
          "type": "string"
        },
        "length": {
          "type": "integer"
        },
        "magic": {
          "type": "string"
        },
        "notes": {
          "type": "string"
        },
        "record_id": {
          "type": "string"
        }
      },
      "required": [
        "length",
        "head_hex",
        "decoded",
        "cleared",
        "notes"
      ],
      "type": "object"
    },
    "population": {
      "properties": {
        "body_patterns": {
          "type": "array"
        },
        "campaign_id": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "summary": {
          "type": "string"
        }
      },
      "required": [
        "name",
        "summary",
        "body_patterns"
      ],
      "type": "object"
    },
    "recommendation": {
      "properties": {
        "addressee": {
          "type": "string"
        },
        "closes_when": {
          "type": "string"
        },
        "evidence_id": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "incident_id": {
          "type": "string"
        },
        "issued": {
          "type": "string"
        },
        "status": {
          "enum": [
            "open",
            "acknowledged",
            "closed-acceptable",
            "closed-unacceptable",
            "superseded"
          ]
        },
        "text": {
          "type": "string"
        }
      },
      "required": [
        "addressee",
        "text",
        "status"
      ],
      "type": "object"
    },
    "record": {
      "properties": {
        "actor_id": {
          "type": "string"
        },
        "body_len": {
          "type": "integer"
        },
        "body_path": {
          "type": "string"
        },
        "body_sha256": {
          "type": "string"
        },
        "campaign_id": {
          "type": "string"
        },
        "claimed_time": {
          "type": "string"
        },
        "clock": {
          "enum": [
            "server",
            "task",
            "wall-claimed"
          ]
        },
        "cluster_basis": {
          "enum": [
            "marker",
            "body",
            "page",
            "classifier",
            "hand"
          ]
        },
        "cluster_id": {
          "type": "string"
        },
        "collection_id": {
          "type": "string"
        },
        "content_kind": {
          "enum": [
            "coordination",
            "answer-share",
            "data-cache",
            "probe-test",
            "bridge",
            "backup",
            "bypass-share",
            "impersonation",
            "storage-link",
            "counter",
            "payload",
            "contact",
            "unknown"
          ]
        },
        "encoding": {
          "type": "string"
        },
        "external_id": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "incident_id": {
          "type": "string"
        },
        "ip_actor_id": {
          "type": "string"
        },
        "kind": {
          "type": "string"
        },
        "observed_time": {
          "type": "string"
        },
        "phase": {
          "enum": [
            "pre-disclosure",
            "post-report",
            "post-press",
            "unknown"
          ]
        },
        "population_basis": {
          "enum": [
            "style",
            "hand"
          ]
        },
        "population_id": {
          "type": "string"
        },
        "source": {
          "type": "string"
        },
        "source_ref": {
          "type": "string"
        },
        "status": {
          "enum": [
            "live",
            "deleted",
            "wiped",
            "placeholder"
          ]
        },
        "summary": {
          "type": "string"
        },
        "time_precision": {
          "enum": [
            "second",
            "minute",
            "hour",
            "day",
            "month"
          ]
        },
        "title": {
          "type": "string"
        },
        "venue_id": {
          "type": "string"
        }
      },
      "required": [
        "venue_id",
        "kind",
        "encoding",
        "phase",
        "status",
        "source"
      ],
      "type": "object"
    },
    "tracker": {
      "properties": {
        "contact": {
          "type": "string"
        },
        "first_seen": {
          "type": "string"
        },
        "holds": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "kind": {
          "enum": [
            "report",
            "dataset",
            "registry",
            "directory",
            "forum",
            "repo",
            "wiki",
            "archive",
            "lab",
            "press",
            "community"
          ]
        },
        "last_checked": {
          "type": "string"
        },
        "licence": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "notes": {
          "type": "string"
        },
        "url": {
          "type": "string"
        }
      },
      "required": [
        "name",
        "kind",
        "holds",
        "notes"
      ],
      "type": "object"
    },
    "venue": {
      "properties": {
        "caveat": {
          "type": "string"
        },
        "default_human": {
          "type": "integer"
        },
        "first_seen": {
          "type": "string"
        },
        "found_by": {
          "type": "string"
        },
        "found_how": {
          "enum": [
            "search",
            "census",
            "watch",
            "report"
          ]
        },
        "found_on": {
          "type": "string"
        },
        "host": {
          "type": "string"
        },
        "id": {
          "type": "string"
        },
        "kind": {
          "type": "string"
        },
        "last_seen": {
          "type": "string"
        },
        "listing_urls": {
          "type": "array"
        },
        "moderator": {
          "type": "string"
        },
        "owner_notified": {
          "type": "string"
        },
        "owner_response": {
          "type": "string"
        },
        "path": {
          "type": "string"
        },
        "software": {
          "type": "string"
        },
        "status": {
          "enum": [
            "live",
            "archived",
            "wiped",
            "gone",
            "candidate"
          ]
        },
        "utc_offset": {
          "type": "string"
        },
        "write_path": {
          "type": "string"
        }
      },
      "required": [
        "host",
        "path",
        "kind",
        "status",
        "listing_urls",
        "default_human"
      ],
      "type": "object"
    },
    "venue_link": {
      "properties": {
        "evidence_id": {
          "type": "string"
        },
        "from_venue": {
          "type": "string"
        },
        "kind": {
          "enum": [
            "exchange",
            "infrastructure",
            "later",
            "overlap",
            "reference"
          ]
        },
        "label": {
          "type": "string"
        },
        "to_venue": {
          "type": "string"
        }
      },
      "required": [
        "from_venue",
        "to_venue",
        "kind"
      ],
      "type": "object"
    }
  },
  "version": "5"
}