To which category do attributes belong within the VERIS schema?

Victim demographics captures information about the affected organization such as industry and size - not the technical attributes of assets involved.

Incident tracking covers metadata such as incident identifiers and timeline fields, not the CIA-related attributes of affected assets.

Discovery and response captures how the incident was detected and what actions were taken, not the security attributes that were compromised.

The VERIS incident description section captures the 4A's: Actor, Action, Asset, and Attribute. Attributes specifically describe the security properties that were compromised on an asset, such as confidentiality, integrity, or availability, making them a core descriptor of what happened during the incident.