data

Data Layer

The /data/ folder contains machine-readable representations of the GenAI Security Crosswalk content, enabling programmatic access, dashboard integration, and downstream tooling without scraping Markdown.

---

Files

File	Purpose
schema.json	JSON Schema (Draft 7) defining the structure of all entry files
incidents-schema.json	JSON Schema for incident entries
incidents.json	50 real-world + research AI security incidents with MAESTRO layer attribution
tools-supplement.json	Supplemental tool entries merged into entries at generation time
entries/	41 machine-readable JSON files — one per OWASP entry (LLM01–LLM10, ASI01–ASI10, DSGAI01–DSGAI21)

---

Schema structure

Every mapping entry conforms to schema.json. Key fields:

{
  "id": "LLM01",
  "name": "Prompt Injection",
  "source_list": "LLM-Top10-2026",
  "severity": "Critical",
  "aivss_score": 9.1,
  "mappings": [
    {
      "framework": "MITRE ATLAS",
      "control_id": "AML.T0054",
      "control_name": "Prompt Injection",
      "tier": "Foundational",
      "scope": "Both",
      "url": "https://atlas.mitre.org/techniques/AML.T0054",
      "notes": "Primary technique for goal hijack via indirect injection"
    }
  ],
  "tools": [
    { "name": "Garak", "url": "https://github.com/leondz/garak", "type": "open-source" }
  ],
  "incidents": [
    { "name": "EchoLeak", "url": "https://...", "year": 2025, "incident_id": "INC-003" }
  ],
  "crossrefs": {
    "agentic_top10": ["ASI01"],
    "dsgai_2026": ["DSGAI01"]
  },
  "audience": ["developer", "security-engineer", "red-teamer"],
  "changelog": [
    { "date": "2026-03-27", "version": "1.0.0", "change": "Initial entry", "author": "OWASP GenAI Data Security Initiative" }
  ]
}

---

Querying the data

CLI query tool (no dependencies)

# Summary statistics
node scripts/query.js --stats

# All Critical severity entries
node scripts/query.js --severity Critical

# All entries mapped to a framework
node scripts/query.js --framework "EU AI Act"

# Full entry detail
node scripts/query.js --entry LLM01

# Tools for a specific entry
node scripts/query.js --entry LLM01 --tools

# Incidents for a specific entry
node scripts/query.js --entry LLM01 --incidents

# Framework mappings for an entry
node scripts/query.js --entry ASI01 --mappings

# Agentic entries only
node scripts/query.js --source-list Agentic

# Entries with AIVSS score above 8.0
node scripts/query.js --aivss-above 8.0

# Framework coverage matrix
node scripts/query.js --framework-coverage

# Search incidents by keyword
node scripts/query.js --incident-search "deepfake"

# JSON output for piping
node scripts/query.js --severity Critical --json

# CSV export
node scripts/query.js --framework "NIST" --format csv

With jq (alternative)

# All Critical severity entries
jq 'select(.severity == "Critical") | .id' data/entries/*.json

# All entries mapping to ISO 42001
jq 'select(.mappings[].framework == "ISO/IEC 42001:2023") | {id, name}' data/entries/*.json

# Tools for LLM01
jq '.tools[].name' data/entries/LLM01.json

# Entries with AIVSS score above 8.0
jq 'select(.aivss_score > 8.0) | {id, name, aivss_score}' data/entries/*.json

Compliance reports

# All 20 frameworks — gap assessment
node scripts/compliance-report.js

# Single framework — multiple formats
node scripts/compliance-report.js --framework "EU AI Act"
node scripts/compliance-report.js --framework "EU AI Act" --format csv
node scripts/compliance-report.js --framework "EU AI Act" --format json
node scripts/compliance-report.js --framework "EU AI Act" --format oscal

# Incident reports
node scripts/incidents-report.js --entry LLM01
node scripts/incidents-report.js --format stix    # STIX 2.1 for SIEM/SOAR

TypeScript / npm

import { getEntry, getFramework, searchEntries } from '@owasp/genai-crosswalk';

const llm01 = getEntry('LLM01');
const euai  = getFramework('EU AI Act');
const hits  = searchEntries('injection');

---

Validating the schema

# Node.js validator (built-in)
node scripts/validate.js

# Or with ajv-cli
npm install -g ajv-cli
ajv validate -s data/schema.json -d data/entries/LLM01.json

---

Source of truth

The Markdown files in /llm-top10/, /agentic-top10/, and /dsgai-2026/ are the authoritative source of all mapping content. The JSON data in /data/entries/ is derived from those files via scripts/generate.js and must stay in sync.

If you find a discrepancy between a Markdown file and a JSON entry, the Markdown file is correct. Run node scripts/generate.js to regenerate, and open a PR.

---

Contributing data entries

When adding a new mapping file:

1. Create the Markdown file following shared/TEMPLATE.md.
2. Run node scripts/generate.js to regenerate JSON entries.
3. Run node scripts/validate.js to confirm consistency.
4. Include both files in your PR.

If you are not comfortable with JSON, submit the Markdown-only PR and note in the PR description that the JSON entry is outstanding — a maintainer will run generate.js after merge.