Catalog YAML format

Catalogues are versioned data files under catalogs/, embedded in the binary. There are three kinds: technique catalogues, methodology catalogues, and crosswalks. Each declares its own provenance and licence so a report can cite which version of each external standard its codes come from. The files in the repository are the authoritative examples; this page describes their shape.

Technique catalogue

A technique catalogue declares a schema, a family, a version, a locale, a name, and a source block with the licence, attribution and last-updated date. Then a list of techniques. Each technique carries an id, a title, what it applies_to, an objective, requirements, a procedure, the expected evidence, a statement of secure behaviour, safety notes, remediation, references, and its mappings.

schema: peart.techniques/v1
family: peart-techniques
version: "1.0"
locale: en
source:
  license: CC-BY-SA-4.0
  attribution: >-
    Original technique content authored for PEART. Mapping codes reference
    OWASP WSTG 4.2, OWASP ASVS 5.0.0 (CC-BY-SA-4.0) and MITRE CWE 4.20.
techniques:
  - id: TECH-INPV-001
    title: SQL Injection Testing
    applies_to: [web, rest_api]
    objective: ...
    mappings:
      - { framework: ASVS, id: "V5.3.4", version: "5.0.0" }
      - { framework: WSTG, id: "WSTG-INPV-05" }
      - { framework: CWE,  id: "CWE-89", title: "SQL Injection" }

The mappings are the hinge: they are what a finding inherits from its linked techniques, and what the compliance crosswalk turns into related controls.

Methodology catalogue

A methodology catalogue declares ordered steps, each linking techniques in position order. It is the plan an engagement adopts, and what the cockpit renders in execution order.

Crosswalk

A crosswalk maps one framework's identifiers to another's. The CWE-to-NIST crosswalk keys on CWE and declares its own versions:

version: "1.0"
nist_revision: "5"
cwe_version: "4.20"
mappings:
  - { cwe: "CWE-89", controls: ["SI-10(6)"], relation: mitigates,
      confidence: high, justification: "SQL injection" }

relation is mitigates or supports; confidence is high or conditional, and a conditional link carries the condition under which it holds. A weakness with no clean control is simply absent (honest coverage), and the deliberately blank ones are recorded in a comment for auditability.