Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

On August 1, 2012, Verizon Business announced that it was making incident-sharing submissions available as a public VERIS dataset and launched veriscommunity.net as a central resource for the community. The initial release came with an important warning: Verizon said the submissions could include test cases, bogus entries, and selection errors, so they were not a clean, decision-grade sample.

What Verizon announced in 2012

Verizon Business said that data submitted anonymously to its incident-sharing program would be publicly accessible through the VERIS Community application. Verizon’s announcement put it plainly: “From now on, every valid submission to the VERIS Community application will be added to a dataset that is publicly accessible.” The announcement also introduced veriscommunity.net as a central place for VERIS information and pointed developers to a beta XML schema, related GitHub resources, and a community mailing list. Verizon’s announcement and SecurityWeek’s August 1, 2012 report describe the launch.

The effort was intended to make incident description and sharing more consistent. SecurityWeek quoted then-Verizon researcher Wade Baker advocating collaborative data sharing as a more effective use of collective resources; that was an argument for sharing, not a claim that the initial submissions had all been validated.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

VERIS, VCDB, and the portal are different things

These names are related, but they refer to separate parts of the ecosystem:

Resource What it is Where to look
VERIS The Vocabulary for Event Recording and Incident Sharing: a structured vocabulary and schema for describing security incidents. vz-risk/veris repository; its merged schema page identifies VERIS Community Schema 1.4.1.
VCDB The VERIS Community Database, a volunteer-supported, free and open effort to record publicly disclosed incidents using VERIS. vz-risk/VCDB repository; its merged schema page identifies VCDB Schema 1.4.1.
2012 community portal The announced website intended to centralize VERIS information and support community submissions and collaboration. Verizon and SecurityWeek reported the launch of veriscommunity.net in 2012; its present operating status is not established by those reports.

VCDB should not be mistaken for all data behind Verizon’s Data Breach Investigations Report (DBIR). Verizon’s 2014 DBIR described VCDB as a volunteer-supported community project, while the VCDB repository explains that agreements limit sharing raw data from Verizon partner and customer datasets. The community database and the DBIR’s broader partner-contributed material therefore have different scopes. Verizon’s 2014 DBIR and the VCDB project repository provide that context.

Why the first dataset carried a quality warning

The 2012 launch report quoted Baker cautioning that the available dataset should be treated as test data rather than used to drive security decisions for the following year. Some submissions might be test cases, bogus entries, or the result of faulty selections in the submission process. He said Verizon planned to adjust the interface and training materials to help users distinguish tests from real incidents and reduce errors. This warning applies to the early dataset and process described at launch; it does not establish that later VCDB releases share the same limitations.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Where to find VERIS and VCDB resources now

The public repositories remain useful destinations for the vocabulary, schema, validation guidance, and community database: VERIS on GitHub and VCDB on GitHub. The schema pages surfaced for both repositories identify version 1.4.1. Check each repository for its current files and documentation rather than assuming a particular dataset snapshot or schema version applies to every release.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The reports establish that Verizon launched veriscommunity.net in 2012, but do not establish whether that domain is currently operational or maintained. The GitHub repositories are the substantiated present-day resource trail; the old portal’s current status should not be assumed from its launch announcement.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.