Add "Using EPSS in SSVC" How-To docs #933
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds two How To docs demonstrating how to use the probability and percentile based decision points in #930 to incorporate EPSS scoring into SSVC decision models. Two approaches are shown:
Some incidental code in support of the tutorials is also added.
Screenshots of the three pages are given below, along with print-to-PDF renderings of the pages. Note that the PDFs expand all collapsed admonition boxes in the page so they appear quite a bit longer than they do when rendered on screen. (All the JSON notation boxes are collapsed on-screen, for example.)
Copilot Summary
This pull request introduces new documentation and code improvements to support using EPSS (Exploit Prediction Scoring System) data with SSVC (Stakeholder-Specific Vulnerability Categorization). The main changes include the addition of comprehensive how-to guides for integrating EPSS scores and percentiles into SSVC decision models, updates to the navigation structure, and enhancements to the codebase to make available various probability and quantile-based decision points.
Documentation enhancements:
mkdocs.yml) to include the new EPSS documentation section and its subpages.Decision point code improvements:
DECISION_POINTSdictionaries to bothprobabilityandquantilesmodules, making it easier to access and enumerate available decision points in code and documentation. [1] [2]Example module additions:
exampledecision point module and a base class for example decision points, laying the groundwork for illustrating custom or sample decision logic. [1] [2]