Examples

Three records, from public CVE to pentest finding.

The same format covers all three. Each record below is the real file from the specification repository, with what it demonstrates and its score worked out the way a validator would.

CIR-2021-00-0001Public vulnerability
CIR-2021-GRP-0003Internal record extending it
CIR-2026-LAB-0012Internal finding, no CVE

Log4Shell, the public record

Public · code 00 TLP:CLEAR

What it shows

core points to CVE-2021-44228 and its GHSA, and never restates them.
Affected versions use OSV ranges: three introduced / fixed pairs describe three disjoint vulnerable intervals.
threat_intel stores KEV and EPSS as a dated snapshot, so the record stays usable offline.
Actors and malware are references (MITRE G0059…), not descriptions, and every claim links to a source.

Public prioritycir-risk/0.1

Severity: CVSS 10.0
Exploitation: In the wild, KEV listed

6 / 6 → 10.0critical

No posture or context: a public record has no organization to describe.

Raw file

# Public vulnerability: Log4Shell (CVE-2021-44228)
cir_version: "0.1"

meta:
  id: CIR-2021-00-0001
  revision: 1
  title: "Log4Shell: JNDI lookup RCE in Apache Log4j 2"
  status: published
  created: 2026-10-12
  updated: 2026-10-12
  tlp: CLEAR
  aliases: [log4shell]

core:
  tlp: CLEAR
  summary: "Remote code execution via JNDI lookups in logged strings in Apache Log4j 2."
  details: |
    Log4j 2 evaluates `${jndi:...}` lookups in logged messages. An attacker who
    controls any logged string (HTTP header, form field, username...) can make
    the application load and execute a remote Java class over LDAP/RMI.
  disclosed: 2021-12-10

  identifiers:
    - type: cve
      id: CVE-2021-44228
    - type: ghsa
      id: GHSA-jfh8-c2jp-5v3q

  references:
    - type: advisory
      url: https://logging.apache.org/log4j/2.x/security.html
    - type: report
      url: https://nvd.nist.gov/vuln/detail/CVE-2021-44228

  affected:
    - product:
        vendor: Apache
        name: log4j-core
        purl: pkg:maven/org.apache.logging.log4j/log4j-core
      ranges:
        - type: ecosystem
          events:
            - introduced: "2.0-beta9"
            - fixed: "2.3.1"
            - introduced: "2.4"
            - fixed: "2.12.2"
            - introduced: "2.13.0"
            - fixed: "2.15.0"

  weaknesses: [CWE-502, CWE-400, CWE-20, CWE-917]

  severity:
    - type: cvss_v3.1
      vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
      score: 10.0
      source: nvd

  remediations:
    - type: upgrade
      description: "Upgrade log4j-core to 2.17.1+ (Java 8), 2.12.4+ (Java 7) or 2.3.2+ (Java 6), which also cover the follow-up CVEs."
      status: available
      reference: https://logging.apache.org/log4j/2.x/security.html
    - type: workaround
      description: "Remove the JndiLookup class from the classpath: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class"
      status: available

threat_intel:
  tlp: CLEAR
  updated: 2026-10-12

  exploitation:
    maturity: weaponized
    in_the_wild: true
    first_seen: 2021-12-01
    exploits:
      - type: module
        source: metasploit
        url: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/log4shell_header_injection.rb

  priority:
    value: 10.0
    level: critical
    method: cir-risk/0.1

  signals:
    kev:
      listed: true
      date_added: 2021-12-10
      ransomware_use: known
    epss:
      score: 0.99999
      percentile: 1.0

  actors:
    - refs: [{ type: mitre, id: G0059 }]
      name: Magic Hound (APT35)
      confidence: high
      sources: [s2]
    - refs: [{ type: mitre, id: G0143 }]
      name: Aquatic Panda
      confidence: high
      sources: [s2]
    - refs: [{ type: mitre, id: G0032 }]
      name: Lazarus Group
      confidence: medium
      sources: [s2]

  malware:
    - name: Khonsari
      family_type: ransomware
      confidence: high
      sources: [s2]
    - name: Mirai
      family_type: botnet
      confidence: high
      sources: [s2]

  attack:
    - { technique: T1190, tactic: TA0001 }
    - { technique: T1059, tactic: TA0002 }
    - { technique: T1105, tactic: TA0011 }

  targeting:
    sectors: [all]

  iocs:
    - type: pattern
      value: "${jndi:"
      confidence: high
      sources: [s3]

  detections:
    - format: sigma
      name: "Log4j RCE CVE-2021-44228 (SigmaHQ)"
      url: https://github.com/SigmaHQ/sigma

  timeline:
    - { date: 2021-12-01, event: "Earliest observed exploitation", sources: [s3] }
    - { date: 2021-12-09, event: "Public PoC released", sources: [s3] }
    - { date: 2021-12-10, event: "Added to CISA KEV", sources: [s1] }

  sources:
    - { id: s1, name: "CISA KEV", url: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", reliability: A }
    - { id: s2, name: "MITRE ATT&CK and vendor reports", url: "https://attack.mitre.org" }
    - { id: s3, name: "Cloudflare", url: "https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/" }

The same issue, inside one organization

Internal · code GRP TLP:AMBER TLP:RED

What it shows

based_on: CIR-2021-00-0001: core and threat_intel are inherited, not copied.
posture is enums only, safe to send to the group CERT. context holds the asset, the incident ticket and the decision.
The decision is mitigate, so a review_on date is mandatory.
Exported to the CERT, context is dropped. See the export.

Organizational riskcir-risk/0.1

Severity: Inherited, CVSS 10.0
Exploitation: Inherited, KEV
Exposure: Egress filtering blocks, full, validated: contained
Impact: Asset criticality critical

9 / 12 → 7.5high

No override applies: exploitation here is only suspected, and the KEV floor needs an open exposure.

Raw file

# Internal record extending a public one (fictional organization).
# core and threat_intel are inherited from the parent (meta.based_on).
# Exported to the group CERT, the TLP filter keeps posture (AMBER) and drops context (RED).
cir_version: "0.1"

meta:
  id: CIR-2021-GRP-0003
  revision: 3
  title: "Log4Shell, subsidiary GRP-ENT-07"
  status: published
  created: 2021-12-11
  updated: 2021-12-14
  tlp: AMBER
  based_on: CIR-2021-00-0001

posture:
  tlp: AMBER
  updated: 2021-12-14
  entity: GRP-ENT-07

  status:
    state: mitigated

  prerequisites:
    attack_vector: network
    privileges: none
    user_interaction: false
    configuration: default
    conditions: []

  exposure:
    reachability: internet
    prevalence: common

  controls:
    - { control: waf, effect: reduces, coverage: partial, validated: true }
    - { control: egress_filtering, effect: blocks, coverage: full, validated: true }
    - { control: edr, effect: detects, coverage: partial, validated: false }

  detection:
    capability: partial
    layers: [waf, network, endpoint]
    validated: true

  impact:
    enables: [code_execution, lateral_movement]
    blast_radius: segment
    chained_with: []

  remediation:
    feasibility: hard
    constraints: [vendor_dependency, legacy]

context:
  tlp: RED
  updated: 2021-12-14
  org: "Filiale Sud"

  assets:
    - ref: CMDB-004812
      name: "portail-clients"
      type: application
      environment: prod
      exposure: internet
      criticality: critical
      data_classification: confidential
      owner: "Equipe Digital"
      state: mitigated
  asset_selectors:
    - source: scanner
      query: "cve:CVE-2021-44228 AND state:open"
      matched: 37

  exploitation:
    status: suspected
    incident_ref: "INC-2021-1207"

  business_impact:
    confidentiality: high
    integrity: high
    availability: medium
    services: ["Espace client", "Paiement en ligne"]
    data_at_risk: [personal, financial]
    regulatory: [gdpr, pci_dss]

  decision:
    action: mitigate
    justification: "Vendor patch unavailable for the payment appliance; WAF and egress filtering in the meantime."
    decided_by: "CISO"
    decided_on: 2021-12-11
    review_on: 2021-12-21
    approved_by: "CIO"

  remediation:
    owner: "Infra team"
    sla: "P1-7d"
    due: 2021-12-18
    status: in_progress
    tickets:
      - { system: jira, id: SEC-3321, url: "https://jira.example.internal/browse/SEC-3321" }

  communication:
    - { audience: soc, date: 2021-12-10, channel: chat, by: "Internal CERT" }
    - { audience: management, date: 2021-12-11, channel: meeting, by: "CISO" }
    - { audience: dpo, date: 2021-12-11, channel: email, by: "CISO" }
    - { audience: cert, date: 2021-12-14, channel: report, by: "CISO" }

  score:
    value: 7.5
    level: high
    method: cir-risk/0.1

  notes:
    - date: 2021-12-12
      author: "SOC"
      text: "JNDI attempts blocked by the WAF since 2021-12-10; one suspicious outbound LDAP request under analysis."

A pentest finding, no CVE

Internal · code LAB TLP:AMBER

What it shows

Same structure as a public record, with an internal identifier (the pentest report) instead of a CVE.
The affected range is a git range: commit hashes, plus the repository they belong to.
The CVSS score comes from the issuer, which wins over any other source.

Organizational riskcir-risk/0.1

Severity: CVSS 6.5
Exploitation: No threat_intel: unknown, counted as public
Exposure: No posture: worst case
Impact: No context: worst case

9 / 12 → 7.5high

High until the organization fills its layers. Its public priority alone is 3 / 6, 5.0 medium: unknowns never make an issue look safer.

Raw file

# Internal issue: pentest finding, no CVE (fictional organization)
cir_version: "0.1"

meta:
  id: CIR-2026-LAB-0012
  revision: 2
  title: "IDOR on invoice export endpoint in billing-api"
  status: published
  created: 2026-09-28
  updated: 2026-10-05
  tlp: AMBER
  authors:
    - name: "Red team"
      org: "Acme"

core:
  tlp: AMBER
  summary: "Any authenticated user can export another customer's invoices by changing the invoice ID."
  details: |
    `GET /api/v2/invoices/{id}/export` checks authentication but not ownership.
    Invoice IDs are sequential, making enumeration trivial.
  disclosed: 2026-09-28

  identifiers:
    - type: internal
      id: "PENTEST-2026-Q3-07"

  references:
    - type: report
      url: https://git.acme.internal/sec/pentests/2026-q3#finding-07
    - type: fix
      url: https://git.acme.internal/billing/billing-api/-/merge_requests/482

  affected:
    - product:
        vendor: Acme
        name: billing-api
      ranges:
        - type: git
          repo: https://git.acme.internal/billing/billing-api
          events:
            - introduced: "a3f9c21"
            - fixed: "e71b0d4"

  weaknesses: [CWE-639]

  severity:
    - type: cvss_v3.1
      vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
      score: 6.5
      source: issuer

  remediations:
    - type: patch
      description: "Ownership check added on invoice export; IDs moved to UUIDv7."
      status: available
      date: 2026-10-04