# cisagov/vulnrichment architecture

> Architecture diagram of the GitHub repository cisagov/vulnrichment, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/cisagov/vulnrichment
- Repository: https://github.com/cisagov/vulnrichment

## Overview

Vulnrichment is a public, year-organized collection of CVE records carrying CISA ADP assessments—not an application runtime. The documented workflow assesses CVEs with SSVC, then conditionally adds supported risk metrics in the ADP container without overwriting CNA data; downstream users consume the resulting records through the usual CVE channels. The tree shows the year directories but no implementation source, so links represent documented process and data flow rather than code calls.

Main entry points: [`2024`](https://github.com/cisagov/vulnrichment/tree/develop/2024) (ADP container)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_assessment["Risk assessment"]
  node_ssvc["SSVC decisions"]
  node_risk["Risk screening"]
end

subgraph group_enrichment["ADP enrichment"]
  node_cwe["CWE analysis"]
  node_cvss["CVSS scoring"]
  node_kev["KEV status"]
  node_cpe["Legacy CPE"]
end

subgraph group_records["CVE records"]
  node_adp["ADP container"]
  node_dataset[("Yearly CVE data")]
end

subgraph group_distribution["Data distribution"]
  node_github["GitHub API"]
  node_cveservices["CVE Services API"]
end

node_analyst(("CISA analyst"))
node_cve["CVE records"]
node_consumers(("Data consumers"))

node_cve -->|"assessed with"| node_ssvc
node_ssvc -->|"screens risk"| node_risk
node_analyst -->|"analyzes"| node_cwe
node_analyst -->|"scores"| node_cvss
node_kev -.->|"adds KEV block"| node_adp
node_cwe -->|"adds CWE"| node_adp
node_cvss -->|"adds CVSS"| node_adp
node_cpe -.->|"historical data"| node_adp
node_ssvc -->|"adds decisions"| node_adp
node_risk -->|"may trigger"| node_cwe
node_risk -->|"may trigger"| node_cvss
node_adp -->|"stored in"| node_dataset
node_dataset -.->|"served through"| node_github
node_dataset -.->|"published to"| node_cveservices
node_github -.->|"provides data"| node_consumers
node_cveservices -.->|"provides data"| node_consumers

click node_adp "https://github.com/cisagov/vulnrichment/tree/develop/2024"
click node_dataset "https://github.com/cisagov/vulnrichment/tree/develop/2024"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_ssvc,node_risk toneBlue
class node_cwe,node_cvss,node_kev,node_cpe toneAmber
class node_adp,node_dataset toneMint
class node_github,node_cveservices toneRose
class node_analyst,node_cve,node_consumers toneIndigo
```

## Components

### Risk assessment

- **SSVC decisions**
- **Risk screening**

### ADP enrichment

- **CWE analysis**
- **CVSS scoring**
- **KEV status**
- **Legacy CPE**

### CVE records

- [ADP container](https://github.com/cisagov/vulnrichment/tree/develop/2024): `2024`
- [Yearly CVE data](https://github.com/cisagov/vulnrichment/tree/develop/2024): `2024`

### Data distribution

- **GitHub API**
- **CVE Services API**

### Other components

- **CISA analyst**
- **CVE records**
- **Data consumers**

## Connections

- CVE records → SSVC decisions: assessed with
- SSVC decisions → Risk screening: screens risk
- CISA analyst → CWE analysis: analyzes
- CISA analyst → CVSS scoring: scores
- KEV status → ADP container: adds KEV block
- CWE analysis → ADP container: adds CWE
- CVSS scoring → ADP container: adds CVSS
- Legacy CPE → ADP container: historical data
- SSVC decisions → ADP container: adds decisions
- Risk screening → CWE analysis: may trigger
- Risk screening → CVSS scoring: may trigger
- ADP container → Yearly CVE data: stored in
- Yearly CVE data → GitHub API: served through
- Yearly CVE data → CVE Services API: published to
- GitHub API → Data consumers: provides data
- CVE Services API → Data consumers: provides data