first version, not sure if CVE in needed for that type

samples/positive/development/webhack_example.json

@@ -0,0 +1,30 @@
+{
+  "Version": "development",
+  "ReporterInfo": {
+    "ReporterOrg": "ExampleOrg",
+    "ReporterOrgDomain": "example.com",
+    "ReporterOrgEmail": "[email protected]",
+    "ReporterContactEmail": "[email protected]",
+    "ReporterContactName": "Mr. Example",
+    "ReporterContactPhone": "+ 01 000 1234567"
+  },
+  "Disclosure": true,
+  "Report": {
+    "ReportClass": "Activity",
+    "ReportType": "WebHack",
+    "Date": "2018-02-05T14:17:10Z",
+    "SourceIp": "192.0.2.59",
+    "SourcePort": 443,
+    "Ongoing": true,
+    "ThreatActor": "malicious devil",
+    "Samples": [
+      {
+        "ContentType": "text/plain",
+        "Base64Encoded": false,
+        "Description": "Requested page does't exist",
+        "Payload": "GET /login.php 404"
+      }
+    ],
+    "CVE": "CVE-1234-56789"
+  }
+}

schemas/development/webhack.schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://raw.githubusercontent.com/xarf/schema-discussion/master/schemas/development/webhack.schema.json",
+  "title": "XARF WEBHACK",
+  "description": "A format to report Web-Hack events.",
+  "allOf": [
+    {
+      "$ref": "xarf_shared.schema.json#/properties/XarfBase"
+    },
+    {
+      "type": "object",
+      "properties": {
+        "Report": {
+          "allOf": [
+            {
+              "$ref": "xarf_shared.schema.json#/properties/IpAndUrlBasedReport"
+            },
+            {
+              "type": "object",
+              "properties": {
+                "ReportClass": {
+                  "type": "string",
+                  "enum": ["Activity"]
+                },
+                "ReportType": {
+                  "type": "string",
+                  "enum": ["WebHack"]
+                }
+              }
+            },
+            {
+              "$ref": "xarf_shared.schema.json#/properties/CommonProps"
+            },
+            {
+              "$ref": "xarf_shared.schema.json#/properties/CVE"
+            }
+          ]
+        }
+      }
+    }
+  ]
+}

schemas/development/xarf.schema.json

@@ -51,6 +51,9 @@
     },
     {
       "$ref": "harassment.schema.json"
+    },
+    {
+      "$ref": "webhack.schema.json"
     }
   ]
 }