Merge pull request #65 from RedHatProductSecurity/scanning-vendor-guidance

Scanning vendor guidance

Author: oaubrey

docs/csaf-vex.md

@@ -529,26 +529,31 @@ The `remediations` object provides additional information about the previously i
 remediations status are available per `product_status` category:
 
 * `fixed`
+
   * `vendor_fix`: For all the product IDs with a fixed product status there will be a corresponding entry
     in the remediations object that correlates each full product ID to the correct RHSAs. The RHSA can be determined by
     the `url` field.
-    * Details: `Fixed`
-    * URL: Link to the RHSA
+    * `details`: Advisory specific information 
+    * `url`: Link to the RHSA
   * `workaround`: If a mitigation exists, it applies to all components regardless of their fix state.
-    * Details: `Mitigation`
+      * `details`: The mitigation statement
+
 * `known_affected`
+
   * `no_fix_planned`: Will include any product IDs with the known affected product status that will not be fixed by Red
   Hat, either because it is out of support scope or the engineering team has decided not to fix it for other reasons.
-    * Details: `Will not fix` or `Out of support scope`
+    * `details`: "Will not fix" or "Out of support scope"
   * `none_available`: Will include any product IDs with the known affected product status that are either still reported
-  affected, meaning a fix is likely in progress, or deferred, which may be fixed at a future date.
-    * Details: `Affected` or `Deferred`
+    affected, meaning a fix is likely in progress, or deferred, which may be fixed at a future date.
+      * `details`: "Affected" or "Deferred"
   * `workaround`: If a mitigation exists, it applies to all components regardless of their fix state.
-    * Details: `Mitigation`
+      * `details`: The mitigation statement
+
 * `known_not_affected`: There are no remediation objects for the known not affected status since it is implicitly
-assumed that there are no remediations needed if the product and component are not affected.
+assumed that no remediation is needed if the product and component are not affected.
+
 * `under_investigation`: There are no remediation objects for the under investigation status since it is implicitly
-assumed that no remediations exist since we are still investigating the vulnerability.
+assumed that no remediation exist while still under investigation.
 
 Note: As with the `product_status` object, there may not be a `remediations` entry for every category. Additionally,
 in VEX files, there may be more than one `vendor_fix` object if more than one RHSA released fixes for the CVE. In the