{
  "title": "CISA KEV watchlist",
  "type": "object",
  "schemaVersion": 1,
  "properties": {
    "vendors": {
      "title": "Vendor terms",
      "type": "array",
      "editor": "stringList",
      "description": "Up to 50 case-insensitive literal substrings of CISA vendorProject, OR within this list. Combine populated vendor/product/CVE/date filters with AND. Empty matches all vendors; terms do not establish installed software exposure.",
      "default": [],
      "sectionCaption": "1 · Define the KEV watchlist",
      "sectionDescription": "OR within vendor/product lists; populated lists and date filters combine with AND."
    },
    "products": {
      "title": "Product terms",
      "type": "array",
      "editor": "stringList",
      "description": "Up to 50 case-insensitive literal substrings of CISA product. Empty matches all products. Source product names can be broad, such as Multiple Products.",
      "default": []
    },
    "cveIds": {
      "title": "Exact CVE IDs",
      "type": "array",
      "editor": "stringList",
      "description": "Up to 100 exact CVE identifiers. Empty matches all CVEs. A missing CVE is not evidence that software is safe.",
      "default": []
    },
    "dateAddedFrom": {
      "title": "Added to KEV on or after",
      "type": "string",
      "editor": "textfield",
      "description": "Optional inclusive CISA dateAdded in real YYYY-MM-DD format. This is catalog addition, not vulnerability publication or discovery."
    },
    "dateAddedTo": {
      "title": "Added to KEV on or before",
      "type": "string",
      "editor": "textfield",
      "description": "Optional inclusive CISA dateAdded in real YYYY-MM-DD format."
    },
    "includeEpss": {
      "title": "Include FIRST EPSS",
      "type": "boolean",
      "default": false,
      "description": "Optional source-labeled daily EPSS score and percentile. Uses bounded public API batches. An outage leaves honest nulls and a partial SUMMARY while preserving primary CISA output. EPSS is excluded from catalog change history.",
      "sectionCaption": "2 · Choose enrichment and output size",
      "sectionDescription": "FIRST EPSS is optional and may be unavailable; its changes do not trigger catalog change history."
    },
    "maxResults": {
      "title": "Maximum saved observations",
      "type": "integer",
      "default": 20,
      "prefill": 20,
      "minimum": 1,
      "maximum": 1000,
      "description": "Save up to this many matching observations, sorted by dateAdded descending then CVE ID. In onlyChanges mode, unchanged rows do not consume this cap. A requested cap is an intentional window, not an error."
    },
    "comparePrevious": {
      "title": "Compare saved catalog history",
      "type": "boolean",
      "default": false,
      "description": "Use a named store scoped to this watchlist and snapshot name. First observations are emitted and establish history only after confirmed dataset saves. One concurrent writer per scope.",
      "sectionCaption": "3 · Optional saved catalog comparisons",
      "sectionDescription": "First observations establish saved history. Use one writer per scope."
    },
    "onlyChanges": {
      "title": "Only new or changed observations",
      "type": "boolean",
      "default": false,
      "description": "Implies comparison. The first run emits matching observations with status new, meaning new to saved history. Later unchanged observations are skipped; a no-op warns and succeeds. Daily EPSS changes alone do not count."
    },
    "snapshotName": {
      "title": "History namespace",
      "type": "string",
      "editor": "textfield",
      "default": "default",
      "description": "1–80 letters, digits, underscores or hyphens. Use a new name to reset history. Different filters create different scopes. Only confirmed saved rows advance history."
    },
    "maxRunSeconds": {
      "title": "Run time budget (seconds)",
      "type": "integer",
      "minimum": 30,
      "maximum": 3600,
      "default": 240,
      "description": "Own wall-clock budget, also capped by the platform deadline minus 25 seconds. Source requests, retries, output and history obey the budget.",
      "sectionCaption": "4 · Run budget",
      "sectionDescription": "Catalog, enrichment and output share the bounded run deadline."
    }
  },
  "description": "Choose a vendor, product or CVE watchlist and optional saved comparisons or FIRST EPSS enrichment. Catalog matches are published vulnerability observations, not a scan of your installed assets."
}