FeedNVDv2

This feed pulls CVE information from the NIST National Vulnerability Database using v2.0 of the API. By default, CVEs with a REJECTED status are excluded. Enable 'Include Rejected CVEs' to ingest them. This integration/feed deprecates the original National Vulnerability Database Feed integraiton as v1.0 of the API is being sunsetted in 2023.

Data Enrichment & Threat Intelligence · NVD Feed 2.0 · Feed

Details

ID	`FeedNVDv2`
Provider	NIST
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

CVE feed from the National Vulnerability Database.

This integration was built and tested with version 2.0 of National Vulnerability Database API. See the NVD Developer API documentation for more information.

An API key for this feed can be obtained at the NIST NVD Developer Website

This integration supports the latest CVSS - Common Vulnerability Scoring System standard - CVSS Version 4.0.

Configure National Vulnerability Database in Cortex

Parameter	Description	Required
Fetch indicators		False
API Key		False
Keyword Search	Returns only the CVEs where the word or phrase is found in the description.	False
CVSS Severity Filter	Filter CVEs by severity. Queries each CVSS version selected in ‘CVSS Versions’.	False
CVSS Versions	CVSS versions to query when the severity filter is set. By default, covers most modern CVEs.	False
Max Indicators Per Fetch	The maximum number of indicators to fetch per interval. A lower value prevents timeouts during initial syncs with large lookback windows. The fetch will automatically resume from where it left off in the next interval. Without an API key, the recommended maximum is 40000. With an API key, the recommended maximum is 200000.	True
First fetch time	How far back should the integration fetch in its first run (1 day, 2 weeks, 3 months, etc.)	False
Return Known Exploited Vulnerabilities (KEV) only.	See the following for more information: https://nvd.nist.gov/developers/vulnerabilities#cves-hasKev	False
Source Reliability	Reliability of the source providing the intelligence data	True
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
		False
Feed Fetch Interval		False
		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Trust any certificate (not secure)		False
Use system proxy settings		False
Tags	Supports CSV values.	False
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False

NOTE ONE - Sample Debug Output - /var/log/demisto/integration_instance.log

Parameter	Value	Description
lastModStartDate	DATE/TIME UTC	The start date for the current CVE fetch cycle.
lastModEndDate	DATE/TIME UTC	The end date for the current CVE fetch cycle.
Fetch I teration	Integer	Current iteration of the overall fetch from NIST NVD.
Iteration Count	Integer	Iteration round through the current fetch cycle. NVD breaks up fetches into chunks to alleviate server load. This is the current count through one of the chunks of CVE data.
Total Results for Iteration	Integer	Total results returned for this fetch cycle chunk.
Current Total Fetched Indicator Count	Integer	Total number of CVEs fetched overall.

lastModStartDate: 2008-09-11T00:00:00.000
lastModEndDate: 2009-01-09T00:00:00.000 
Fetch Iteration: 5
Iteration Count: 0
Total Results for Iteration: 1
Current Total Fetched Indicator Count: 4184

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.

nvd-get-indicators

Manually retrieve CVEs from NVD using the history parameter for the duration back to fetch. CVSS severity and version filters can be overridden for this command.

Base Command

!nvd-get-indicators history="7 days"

Input

Argument Name	Description	Required
history	Time back to retrieve CVEs, e.g. `7 days`. Possible values are: 7 days.	Required
keyword	Keywords to query CVEs by.	Optional
limit	The maximum number of CVEs to return. Use a lower value to avoid timeouts due to large lookback windows. Default is 50.	Optional
cvss_severity	A comma-separated list of CVSS severities to use for this command. This overrides the instance-level CVSS Severity Filter. If left blank, the instance-level filter is used. Possible values are: CRITICAL, HIGH, MEDIUM, LOW.	Optional
cvss_versions	Override the instance-level CVSS Versions for this command. Comma-separated list. Possible values are: CVSS v4, CVSS v3, CVSS v2.	Optional

Context Output

Path	Type	Description
CVE.ID	String	The ID of the CVE.
CVE.CVSS	Number	The CVSS score of the CVE.
CVE.Published	Date	The date the CVE was published.
CVE.Modified	Date	The date that the CVE was last modified.
CVE.Description	String	The description of the CVE.
CVE.CVSSVersion	String	The CVSS version used for scoring (e.g. 4.0, 3.1, 2.0).
CVE.Severity	String	The CVSS severity level (e.g. CRITICAL, HIGH, MEDIUM, LOW).

Configuration parameters

feed — Fetch indicators
apiKey —
keyword_search — Keyword Search
cvssv3severity — CVSS 3 Severity Filter
cvss_severity — CVSS Severity Filter
cvss_versions — CVSS Versions
max_indicators — Max Indicators Per Fetch (required)
first_fetch — First fetch time
hasKev — Return Known Exploited Vulnerabilities (KEV) only.
include_rejected — Include Rejected CVEs
feedIncremental — Incremental feed
feedReliability — Source Reliability (required)
feedReputation — Indicator Reputation
feedExpirationPolicy —
feedFetchInterval — Feed Fetch Interval
feedExpirationInterval —
feedBypassExclusionList — Bypass exclusion list
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feedTags — Tags
tlp_color — Traffic Light Protocol Color

Commands (1)

nvd-get-indicators
Manually retrieve CVEs from NVD using the history parameter for the duration back to fetch. CVSS severity and version filters can be overridden for this command.

Source

FeedNVDv2.py FeedNVDv2_test.py FeedNVDv2.yml FeedNVDv2_description.md

Download History Raw

## NIST NVD CVE FEED
Use this feed to create a feed of CVEs from NIST.

### Rate Limits
NIST firewall rules put in place to prevent denial of service attacks can thwart your application if it exceeds a predetermined rate limit. The public rate limit (without an API key) is 5 requests in a rolling 30 second window; the rate limit with an API key is 50 requests in a rolling 30 second window. Requesting an API key significantly raises the number of requests that can be made in a given time frame. However, it is still recommended that your application sleeps for several seconds between requests so that legitimate requests are not denied, and all requests are responded to in sequence.

### API Key
The feed does not require an API key but having one greatly increases the quota that can be used. The API key can be obtained for 
free from NIST, just follow [this link and its instructions](https://nvd.nist.gov/developers/request-an-api-key).

### Filters
1. **CVSS Severity Filter** - Filters CVEs by their CVSS Score, Supporting the latest CVSS Common Vulnerability Scoring System standard.
2. **Keyword Search** - Uses a keyword (or a sentence) to filter out CVEs by their description. You can test this prior to setup using [NIST website](https://nvd.nist.gov/vuln/search).
3. **KEV Only** - Returns the CVE that appears in CISA's [Known Exploited Vulnerabilities (KEV) Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).

[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/feed-nv-dv2)