Every CVE is already a CIR. No lookup table needed.

Or link it directly: /cir/CVE-2021-44228 for the page, /cir/CIR-2021-1CVE-44228.yml for the YAML.

CVE-YYYY-N

becomes CIR-YYYY-1CVE-N: same year, same number. Anyone can compute it, offline.

What it holds

core (description, references, CWE, CVSS 3.1 / 4.0 from NVD) and threat_intel (CISA KEV, EPSS, public exploit links), both CLEAR. Never posture or context.

Freshness

Regenerated from its sources at most every six hours. A rejected CVE gives status: rejected.

Not editable

To add knowledge, write your own record with based_on: an authority record for public analysis, an internal one for your posture and context.

# core and threat_intel come from the mirror
cir_version: "0.5"
meta:
  id: CIR-2021-GRP-0003
  title: "Log4Shell, subsidiary GRP-ENT-07"
  tlp: AMBER
  based_on: CIR-2021-1CVE-44228
posture:
  tlp: AMBER
  status: { state: mitigated }
context:
  tlp: RED
  decision: { action: mitigate }

Full rules in the specification.