ACTI Vulnerability Query
ACTI provides intelligence regarding security threats and vulnerabilities.
Vulnerability Management · Accenture CTI v2
Details
| ID | ACTI Vulnerability Query |
|---|---|
| Provider | Accenture |
| Category | Vulnerability Management |
| From Version | 5.5.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Accenture CTI provides intelligence regarding security threats and vulnerabilities.
This integration was integrated and tested with version v2.93.0 of ACTI
Configure ACTI Vulnerability Query in Cortex
| Parameter | Description | Required |
|---|---|---|
| url | URL | True |
| api_token | API Token | True |
| Source Reliability | Reliability of the source providing the intelligence data. | B - Usually reliable |
| insecure | Trust any certificate (not secure) | False |
| use_proxy | Use system proxy settings | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
acti-vuln
Checks the reputation of the given common vulnerabilities and exposures ID.
Base Command
acti-vuln
Input
| Argument Name | Description | Required |
|---|---|---|
| cve | CVE ID to check. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CVE.ID | String | The ID of the CVE, for example: CVE-2022-1653 |
| CVE.CVSS2 | String | The CVSS2 temporal score of the CVE based on exploitability, remediation level & report confidence, for example: 10.0 |
| CVE.CVSS3 | String | The CVSS3 temporal score of the CVE based on exploitability, remediation level & report confidence, for example: 10.0 |
| CVE.Published | String | The timestamp of when the CVE was published. |
| CVE.Modified | String | The timestamp of when the CVE was last modified. |
| CVE.Description | String | A description of the CVE. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Reliability | String | Reliability of the source providing the intelligence data. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor that was used to calculate the score. |
| DBotScore.Score | String | The actual score. |
Command Example
!acti-vuln cve=CVE-2022-1653
Context Example
{
"DBotScore": {
"Indicator": "CVE-2022-1653",
"Reliability": "B - Usually reliable",
"Score": 2,
"Type": "cve",
"Vendor": "ACTI Vulnerability Query"
},
"CVE": {
"CVSS2": "10.0",
"CVSS3": "10.0",
"Description": "Description of the vulnerability",
"ID": "CVE-2022-1653",
"Modified": "2022-01-27 03:40:00",
"Published": "2022-01-22 04:01:42",
}
}
Human Readable Output
Results
CPEs CVSS2 CVSS3 DbotReputation Description LastModified LastPublished Name UUID cpe:/a:f5:big-ip:16.1.1 10 10 2 Description of the vulnerability 2022-01-27 03:40:00 2022-01-22 04:01:42 CVE-2022-1653 cbc55efe-aa5c-4114-b532-e44f9b824fe1
Configuration parameters
url— URL (required)api_token— (required)integrationReliability— Source Reliability (required)insecure— Trust any certificate (not secure)use_proxy— Use system proxy settings
Commands (1)
-
acti-vulnChecks reputation of the vulnerability.
category: Vulnerability Management provider: Accenture commonfields: id: ACTI Vulnerability Query version: -1 sectionorder: - Connect - Collect configuration: - display: URL defaultvalue: https://api.intelgraph.idefense.com/ name: url required: true type: 0 section: Connect - displaypassword: API Token additionalinfo: The API Token to use for connection name: api_token required: true hiddenusername: true type: 9 section: Connect - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 section: Collect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: use_proxy type: 8 required: false section: Connect description: ACTI provides intelligence regarding security threats and vulnerabilities. display: ACTI Vulnerability Query name: ACTI Vulnerability Query script: commands: - name: acti-vuln arguments: - name: cve default: true description: Checks the CVE ID for related vulnerability data. isArray: true outputs: - contextPath: CVE.ID description: 'The ID of the CVE, for example: CVE-2015-1653.' type: String - contextPath: CVE.CVSS2 description: 'The CVSS2 temporal score of the CVE based on exploitability, remediation level & report confidence, for example: 10.0.' type: String - contextPath: CVE.CVSS3 description: 'The CVSS3 temporal score of the CVE based on exploitability, remediation level & report confidence, for example: 10.0.' type: String - contextPath: CVE.Published description: The timestamp of when the CVE was published. type: String - contextPath: CVE.Modified description: The timestamp of when the CVE was last modified. type: String - contextPath: CVE.Description description: A description of the CVE. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor that was used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number description: Checks reputation of the vulnerability. runonce: false script: '-' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 fromversion: 5.5.0 tests: - ACTI Vulnerability Query Test