Flatbuffer schemas

The Vulnerability Scanner uses FlatBuffers for two purposes:

• InventorySync transport: InventorySync sessions are sent as FlatBuffers (Start/DataValue/DataContext/End).
• CTI feed processing: CVE5 content is processed into local databases with FlatBuffer-aware parsers to reduce JSON overhead during scans.

InventorySync schema (SyncSchema)

The schema is defined in src/shared_modules/utils/flatbuffers/schemas/inventorySync.fbs and is shared across modules that participate in inventory synchronization.

Message sequence

InventorySync sessions follow this pattern:

Start -> StartAck -> DataValue/DataContext -> End -> EndAck

DataClean and ChecksumModule exist in the schema for other synchronization modes, but VD only consumes Start/DataValue/DataContext/End.

Enums

• Mode: ModuleFull, ModuleDelta, ModuleCheck, MetadataDelta, MetadataCheck, GroupDelta, GroupCheck
• Option: Sync, VDFirst, VDSync
• Operation: Upsert, Delete
• Status: Ok, Error, Offline, ChecksumMismatch

Core tables used by VD

Start

Carries session metadata and the initial OS/agent context used to seed ScanContext.

Field	Description
module	Module name sending the session.
mode	Synchronization mode.
size	Total number of items in the session.
index	List of indices derived from DataValue items in the session.
option	VD mode: VDFirst or VDSync.
architecture, hostname, osname, osplatform, ostype, osversion	Agent OS metadata (agent.host.os).
agentversion, agentname, agentid	Agent metadata.
groups	Agent groups.
global_version	Optional global version used for inventory state updates.

DataValue

Represents inventory deltas and carries the inventory document as JSON.

Field	Description
seq	Sequence number within the session.
session	Session identifier (from StartAck).
operation	Upsert or Delete.
id	Inventory document identifier (used by VD as item id / detection base).
index	Inventory index name.
version	Inventory document version.
data	JSON inventory document (host/package schema).

DataContext

Represents inventory context for deltas. It uses the same data JSON schema as DataValue but has no operation or version.

Field	Description
seq	Sequence number within the session.
session	Session identifier (from StartAck).
id	Inventory document identifier.
index	Inventory index name.
data	JSON inventory document (host/package schema).

End

Marks the end of the session and triggers post-processing (including VD runs for VDFirst/VDSync).