Cybersixgill_DVE_Enrichment

By enriching CVEs with the DVE Score, Cortex XSOAR customers gain deeper visibility with relevant threat intel from the deep and dark web with dynamic attributes such as where they are trending, POC exploit details, and more. Loaded with extra-context, this allows users to accurately understand the real impact of CVEs to effectively prioritize critical vulnerabilities.

Data Enrichment & Threat Intelligence · Cybersixgill-DVE

Details

IDCybersixgill_DVE_Enrichment
ProviderBitSight
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/sixgill:1.0.0.10120494
Supported ModulesAgentix XSIAM

README

Powered by the broadest automated collection from the deep and dark web, Cybersixgill’s Dynamic Vulnerability Exploit (DVE) Score is a feed of common known vulnerabilities, scored by their probability of getting exploited. The DVE Score feed enables Cortex XSOAR users to track threats from vulnerabilities that others define as irrelevant, but have a higher probability of being exploited. It is the only solution that predicts the immediate risks of a vulnerability based on threat actors’ intent.

DVE Score is also the most comprehensive CVE enrichment solution on the market: Cortex XSOAR users gain unparalleled context and can accelerate threat response and decision making, effectively giving security teams a head start on vulnerability management.

· Anticipate the exploitation of a vulnerability up to 90 days in advance
· Track threats from CVEs that most others define as irrelevant or obsolete, but a higher probability of being exploited by active cyber threat actors.
· Gain visibility as well as the ability to prioritize and articulate the remediation process across the organization - straight from Cortex XSOAR

To obtain access to Cybersixgill DVE Score feed via Cortex XSOAR, please contact Cybersixgill at getstarted@cybersixgill.com.

Configure Sixgill_Darkfeed_Enrichment in Cortex

Parameter Description Required
Sixgill API client ID Sixgill API client ID True
Sixgill API client secret Sixgill API client secret True
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cybersixgill-cve-enrich

Returns information for each CVE in the input list.

Base Command

cybersixgill-cve-enrich

Input

Argument Name Description Required
cve_id comma separated list of cves id. Required

Context Output

Path Type Description
Sixgill.CVE.value String CVE ID.
Sixgill.CVE.Description String Description of the given DVE ID.
Sixgill.CVE.Created Date The creation date of the CVE.
Sixgill.CVE.Modified Date The modified date of the CVE.
Sixgill.CVE.Cybersixgill_DVE_score_current String The current Sixgill DVE Score.
Sixgill.CVE.Cybersixgill_DVE_score_highest_ever_date Date The date on which Sixgill’s highest DVE score ever reported.
Sixgill.CVE.Cybersixgill_DVE_score_highest_ever String Sixgill’s highest DVE score ever reported.
Sixgill.CVE.Cybersixgill_Previously_exploited_probability String Sixgill’s score of previously exploited probability.
Sixgill.CVE.Previous_Level String Previous level of the CVE ID.
Sixgill.CVE.CVSS_3_1_score String CVSS 3.1 score.
Sixgill.CVE.CVSS_3_1_severity String CVSS 3.1 severity.
Sixgill.CVE.NVD_Link String NVD link.
Sixgill.CVE.NVD_last_modified_date Date NVD last modified date.
Sixgill.CVE.NVD_publication_date Date NVD publication date.
Sixgill.CVE.CVSS_2_0_score String CVSS 2.0 score.
Sixgill.CVE.CVSS_2_0_severity String CVSS 2.0 severity.
Sixgill.CVE.NVD_Vector_V2_0 String NVD vector v2.0.
Sixgill.CVE.NVD_Vector_V3_1 String NVD vector v3.1.
Sixgill.CVE.rawJSON String The raw JSON of the CVE entich information.

cybersixgill-cve-remediation

Returns remediation for each CVE in the input list.

Base Command

cybersixgill-cve-remediation

Input

Argument Name Description Required
cve_id comma separated list of cves id. Required

Context Output

Path Type Description
Sixgill.CVE.value String CVE ID.
Sixgill.CVE.Description String Description of the given DVE remediation.
Sixgill.CVE.Solutions String Possible remediation solutions for the CVE ID.
Sixgill.CVE.rawJSON String The raw JSON of the CVE entich information.

Configuration parameters

  • client_id — Sixgill API client ID (required)
  • client_secret — Sixgill API client secret (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (2)

  • cybersixgill-cve-enrich

    Returns information for each CVE in the input list.

  • cybersixgill-cve-remediation

    Returns remediation for each CVE in the input list.

Source

CybersixgillDVEEnrichment.py CybersixgillDVEEnrichment_test.py CybersixgillDVEEnrichment.yml CybersixgillDVEEnrichment_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
commonfields:
  id: Cybersixgill_DVE_Enrichment
  version: -1
configuration:
- display: Sixgill API client ID
  name: client_id
  required: true
  type: 0
  section: Connect
- display: Sixgill API client secret
  name: client_secret
  required: true
  type: 4
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: By enriching CVEs with the DVE Score, Cortex XSOAR customers gain deeper visibility with relevant threat intel from the deep and dark web with dynamic attributes such as where they are trending, POC exploit details, and more. Loaded with extra-context, this allows users to accurately understand the real impact of CVEs to effectively prioritize critical vulnerabilities.
display: Cybersixgill DVE Enrichment
name: Cybersixgill_DVE_Enrichment
script:
  commands:
  - arguments:
    - default: true
      isArray: true
      name: cve_id
      description: 'comma separated list of cves id.'
      required: true
    description: Returns information for each CVE in the input list.
    name: cybersixgill-cve-enrich
    outputs:
    - contextPath: Sixgill.CVE.value
      description: CVE ID.
      type: String
    - contextPath: Sixgill.CVE.Description
      description: Description of the given DVE ID.
      type: String
    - contextPath: Sixgill.CVE.Created
      description: The creation date of the CVE.
      type: Date
    - contextPath: Sixgill.CVE.Modified
      description: The modified date of the CVE.
      type: Date
    - contextPath: Sixgill.CVE.Cybersixgill_DVE_score_current
      description: The current Sixgill DVE Score.
      type: String
    - contextPath: Sixgill.CVE.Cybersixgill_DVE_score_highest_ever_date
      description: The date on which Sixgill's highest DVE score ever reported.
      type: Date
    - contextPath: Sixgill.CVE.Cybersixgill_DVE_score_highest_ever
      description: Sixgill's highest DVE score ever reported.
      type: String
    - contextPath: Sixgill.CVE.Cybersixgill_Previously_exploited_probability
      description: Sixgill's score of previously exploited probability.
      type: String
    - contextPath: Sixgill.CVE.Previous_Level
      description: Previous level of the CVE ID.
      type: String
    - contextPath: Sixgill.CVE.CVSS_3_1_score
      description: CVSS 3.1 score.
      type: String
    - contextPath: Sixgill.CVE.CVSS_3_1_severity
      description: CVSS 3.1 severity.
      type: String
    - contextPath: Sixgill.CVE.NVD_Link
      description: NVD link.
      type: String
    - contextPath: Sixgill.CVE.NVD_last_modified_date
      description: NVD last modified date.
      type: Date
    - contextPath: Sixgill.CVE.NVD_publication_date
      description: NVD publication date.
      type: Date
    - contextPath: Sixgill.CVE.CVSS_2_0_score
      description: CVSS 2.0 score.
      type: String
    - contextPath: Sixgill.CVE.CVSS_2_0_severity
      description: CVSS 2.0 severity.
      type: String
    - contextPath: Sixgill.CVE.NVD_Vector_V2_0
      description: NVD vector v2.0.
      type: String
    - contextPath: Sixgill.CVE.NVD_Vector_V3_1
      description: NVD vector v3.1.
      type: String
    - contextPath: Sixgill.CVE.rawJSON
      type: String
      description: The raw JSON of the CVE entich information.

  - arguments:
    - default: true
      isArray: true
      name: cve_id
      description: comma separated list of cves id.
      required: true
    description: Returns remediation for each CVE in the input list.
    name: cybersixgill-cve-remediation
    outputs:
    - contextPath: Sixgill.CVE.value
      description: CVE ID.
      type: String
    - contextPath: Sixgill.CVE.Description
      description: Description of the given DVE remediation.
      type: String
    - contextPath: Sixgill.CVE.Solutions
      description: Possible remediation solutions for the CVE ID.
      type: String
    - contextPath: Sixgill.CVE.rawJSON
      description: The raw JSON of the CVE entich information.
      type: String
  dockerimage: demisto/sixgill:1.0.0.10120494
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.5.0
tests:
- No tests (auto formatted)
sectionorder:
- Connect
provider: BitSight