Exploit Discovery

This document defines the data structure for "Exploit Discovery" documents. These are extracted from sources reporting on proof-of-concept exploits, attack techniques, or real-world exploit sightings related to known vulnerabilities.

🧱 Core Fields

Field	Type	Description
`summary`	string	Short summary of the exploit or technique described.
`title`	string	Title of the original article or exploit report.
`published_date`	string (ISO 8601)	Date when the article was first published.
`last_updated_date`	string (ISO 8601)	Last updated date from the source.
`disclosed_date`	string (ISO 8601)	Date when the exploit was publicly disclosed (if different).
`scraped_date`	string (ISO 8601)	Date when we ingested the data.
`url`	string	Link to the original article or report.
`publishing_company`	string	Name of the organization or researcher publishing the report.
`classification`	string	Always set to `Exploit Discovery` for this type.

🎯 Exploit-Specific Fields

Field	Type	Description
`CVEs`	List[string]	List of referenced CVE identifiers, if available.
`solution`	string	Known mitigation or detection strategies.
`vulnerable_products`	List[string]	Flat list of affected product mentions.
`product_vendor`	string	Vendor of the affected products.
`exploit_creator`	string	Name or alias of the exploit author or source.
`references`	List[string]	Related URLs or technical references.

✅ Integration Guidance

Use classification == "Exploit Discovery" to group this category.
exploit_creator may refer to an individual, group, or alias (e.g., "Shadow Brokers").
solution may be empty if no known fix or detection is proposed.
Dates follow ISO 8601 (e.g., 2025-06-01T00:00:00Z).
disclosed_date can differ from published_date in coordinated disclosure scenarios.

Published with Nuclino