Date of First Known Exploitation (first_known_exploitation_date)

[santosomar]

Consider the addition of Date of First Known Exploitation (first_known_exploitation_date)

Background information:

As discussed in today's meeting (2024-12-18) and as a follow up to Stefan's statement above, we will also create a new issue to address address the second element discussed here (Date of First Known Exploitation (first_known_exploitation_date)) in a separate issue.

The issue was further discussed during the 2024-12-18 TC meeting with focus on part 1 renaming the existing field release_date to disclosure_date. Omar moved to reinstate the field name for the date a vulnerability was first published from release_date to disclosure_date, Denny seconded. No discussion, no objections, the motion carries.

Originally posted by @santosomar in #782 (comment)

[santosomar]

Date of First Known Exploitation (first_known_exploitation_date)

• Type: String of format date-time.
• Definition: Records the date and time the vulnerability was first observed to be exploited in the wild. This is good for representing CISA KEVs, etc.
• Exclusions: Does not include exploitation in lab or testing environments.

Rationale:
This should be an OPTIONAL field.