Methodologies and catalogs

Catalogs are global

Techniques and methodology frameworks live in a catalogue that is global to the installation, not per-engagement. You import a catalogue once and every engagement can adopt from it. This is why editing a technique's mapping in the catalogue flows through to every finding that links it: there is one source, not a copy per engagement.

Importing a catalogue

A catalogue is imported from a file in the format the tooling under tools/ produces (the technique and methodology catalogues, and the framework provenance they declare). The import records the catalogue's own provenance and licence, so a report can cite which version of each external standard the codes come from. Because techniques carry mappings to WSTG, ASVS and CWE, a well-formed catalogue is what makes the compliance derivation possible downstream.

Adopting a framework in an engagement

An engagement adopts one or more methodology frameworks. Adopting a framework is what populates the cockpit's methodology navigator with its steps and techniques, in execution order, so the pentester has a plan to work through. An engagement can carry more than one framework when the scope needs it (for example a web baseline plus an API-specific set).

Keeping the catalogue honest

The catalogue is data, versioned, with declared provenance. When you propose a new technique or methodology, it goes through the same discipline as any catalogue content: see Proposing a technique or methodology. The point is that what drives a report is a citable, versioned catalogue, not ad-hoc text typed into one engagement.