Hackuity

From a war-room, query your Hackuity cockpit in order to seamlessly retrieve information related to your vulnerability stock.

Vulnerability Management · Hackuity

Details

IDHackuity
ProviderHackuity
CategoryVulnerability Management
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

From a war-room, query your Hackuity cockpit in order to seamlessly retrieve information related to your vulnerability stock.
This integration was integrated and tested with version 1.25.0 of Hackuity

Configure Hackuity in Cortex

Parameter Required
Corporate server URL True
Namespace True
Api key True
Trust any certificate (not secure) False
Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

hackuity-search-findings

Search for findings in Hackuity.

Base Command

hackuity-search-findings

Input

Argument Name Description Required
asset_name The name of the asset. Optional
asset_type The type of the asset if the asset name is specified (by default, restricts to IPs & domains). Optional
attribute An attribute value. Optional
cvss_min The minimum CVSS (included). Optional
cvss_max The maximum CVSS (excluded). Optional
limit The maximum number of items to return. Default is 20. Optional
trs_min The minimum TRS (included). Optional
trs_max The maximum TRS (excluded). Optional
vuln_type The vulnerability type (ID). Optional

Context Output

Path Type Description
Hackuity.Findings.Asset.ID String The ID of the asset
Hackuity.Findings.Asset.Name String The name of the asset
Hackuity.Findings.Asset.Type String The type of the asset
Hackuity.Findings.Attributes Unknown The attributes of the finding
Hackuity.Findings.Score.CVSS Number The CVSS of the finding
Hackuity.Findings.Score.TRS Number The TRS of the finding
Hackuity.Findings.ID String The ID of the finding
Hackuity.Findings.Status.Ignored Boolean Whether the finding is ignored
Hackuity.Findings.Status.State String The state of the finding
Hackuity.Findings.Status.SubState String The sub-state of the finding
Hackuity.Findings.Status.LastClosedAt Date The date of the last time the finding was closed
Hackuity.Findings.VulnType.ID String The ID of the vulnerability type
Hackuity.Findings.VulnType.Name String The name of the vulnerability type

Command example

!hackuity-search-findings asset_name=example.com

Context Example

{
    "Hackuity": {
        "Findings": [
            {
                "Asset": {
                    "ID": "NKTVm2RU4606",
                    "Name": "example.com",
                    "Type": "DOMAIN"
                },
                "Attributes": {
                    "cve_id": "CVE-2015-6550"
                },
                "ID": "j6SMpiorqFi1",
                "Score": {
                    "CVSS": 10,
                    "TRS": 693
                },
                "Status": {
                    "Ignored": false,
                    "State": "CLOSED",
                    "SubState": "FIXED"
                },
                "VulnType": {
                    "ID": "common-vulnerability-exposure",
                    "Name": "Common Vulnerability and Exposure (CVE)"
                }
            },
            {
                "Asset": {
                    "ID": "NKTVm2RU4606",
                    "Name": "example.com",
                    "Type": "DOMAIN"
                },
                "Attributes": {
                    "cve_id": "CVE-2015-6551"
                },
                "ID": "ag8FkNpubY7N",
                "Score": {
                    "CVSS": 10,
                    "TRS": 693
                },
                "Status": {
                    "Ignored": false,
                    "State": "CLOSED",
                    "SubState": "FIXED"
                },
                "VulnType": {
                    "ID": "common-vulnerability-exposure",
                    "Name": "Common Vulnerability and Exposure (CVE)"
                }
            }
        ]
    }
}

Human Readable Output

Findings

Asset VulnType Attributes Score Status
ID: NKTVm2RU4606
Name: example.com
Type: DOMAIN		 ID: common-vulnerability-exposure
Name: Common Vulnerability and Exposure (CVE)		 cve_id: CVE-2015-6550 CVSS: 10.0
TRS: 693		 Ignored: false
State: CLOSED
SubState: FIXED
ID: NKTVm2RU4606
Name: example.com
Type: DOMAIN		 ID: common-vulnerability-exposure
Name: Common Vulnerability and Exposure (CVE)		 cve_id: CVE-2015-6551 CVSS: 10.0
TRS: 693		 Ignored: false
State: CLOSED
SubState: FIXED

hackuity-search-vulndb-vulnerabilities

Search for vulndb vulnerabilities in Hackuity.

Base Command

hackuity-search-vulndb-vulnerabilities

Input

Argument Name Description Required
asset_name The name of the asset. Optional
asset_type The type of the asset if the asset name is specified (by default, restricts to IPs & domains). Optional
attribute An attribute value. Optional
cvss_min The minimum CVSS (included). Optional
cvss_max The maximum CVSS (excluded). Optional
limit The maximum number of items to return. Default is 20. Optional
trs_min The minimum TRS (included). Optional
trs_max The maximum TRS (excluded). Optional
vuln_type The vulnerability type (ID). Optional

Context Output

Path Type Description
Hackuity.Vulnerabilities.Attributes String The attributes of the vulnerability
Hackuity.Vulnerabilities.Score.CVSS String The CVSS of the vulnerability
Hackuity.Vulnerabilities.Score.TRS String The TRS of the vulnerability
Hackuity.Vulnerabilities.Description String The description of the vulnerability
Hackuity.Vulnerabilities.ID String The ID of the vulnerability
Hackuity.Vulnerabilities.Seen.First Date The date of the first time the vulnerability has been seen
Hackuity.Vulnerabilities.Findings.Total String The total number of findings on this vulnerability
Hackuity.Vulnerabilities.Findings.Open String The number of open findings on this vulnerability
Hackuity.Vulnerabilities.Findings.Closed String The number of closed findings on this vulnerability
Hackuity.Vulnerabilities.Findings.Ignored String The number of ignored findings on this vulnerability
Hackuity.Vulnerabilities.VulnType.ID String The ID of the vulnerability type
Hackuity.Vulnerabilities.VulnType.Name String The name of the vulnerability type

Command example

!hackuity-search-vulndb-vulnerabilities asset_name=example.com

Context Example

{
    "Hackuity": {
        "Vulnerabilities": [
            {
                "Attributes": [
                    {
                        "key": "cve_id",
                        "value": "CVE-2020-0705"
                    }
                ],
                "Description": "An information disclosure vulnerability exists when the Windows Network Driver Interface Specification (NDIS) improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Network Driver Interface Specification (NDIS) Information Disclosure Vulnerability'.",
                "Findings": {
                    "Closed": 0,
                    "Ignored": 0,
                    "Open": 1,
                    "Total": 1
                },
                "ID": "hy#asset/NKTVm2RU4606:LWxh4Y7UpCUw",
                "Score": {
                    "CVSS": 9,
                    "TRS": 636
                },
                "Seen": {
                    "First": "2021-03-03T07:56:07Z"
                },
                "VulnTypes": [
                    {
                        "ID": "common-vulnerability-exposure",
                        "Name": "Common Vulnerability and Exposure (CVE)"
                    }
                ]
            },
            {
                "Attributes": [
                    {
                        "key": "cve_id",
                        "value": "CVE-2020-0958"
                    }
                ],
                "Description": "An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0956, CVE-2020-0957.",
                "Findings": {
                    "Closed": 0,
                    "Ignored": 0,
                    "Open": 1,
                    "Total": 1
                },
                "ID": "hy#asset/NKTVm2RU4606:mTYugfvOy9yt",
                "Score": {
                    "CVSS": 9,
                    "TRS": 636
                },
                "Seen": {
                    "First": "2021-03-03T07:56:07Z"
                },
                "VulnTypes": [
                    {
                        "ID": "common-vulnerability-exposure",
                        "Name": "Common Vulnerability and Exposure (CVE)"
                    }
                ]
            }
        ]
    }
}

Human Readable Output

VulnDB vulnerabilities

VulnTypes Description Attributes Score Findings Seen
{‘ID’: ‘common-vulnerability-exposure’, ‘Name’: ‘Common Vulnerability and Exposure (CVE)’} An information disclosure vulnerability exists when the Windows Network Driver Interface Specification (NDIS) improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka ‘Windows Network Driver Interface Specification (NDIS) Information Disclosure Vulnerability’. {‘key’: ‘cve_id’, ‘value’: ‘CVE-2020-0705’} CVSS: 9.0
TRS: 636		 Total: 1
Open: 1
Closed: 0
Ignored: 0		 First: 2021-03-03T07:56:07Z
{‘ID’: ‘common-vulnerability-exposure’, ‘Name’: ‘Common Vulnerability and Exposure (CVE)’} An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka ‘Win32k Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2020-0956, CVE-2020-0957. {‘key’: ‘cve_id’, ‘value’: ‘CVE-2020-0958’} CVSS: 9.0
TRS: 636		 Total: 1
Open: 1
Closed: 0
Ignored: 0		 First: 2021-03-03T07:56:07Z

hackuity-search-provider-vulnerabilities

Search for provider vulnerabilities in Hackuity.

Base Command

hackuity-search-provider-vulnerabilities

Input

Argument Name Description Required
asset_name The name of the asset. Optional
asset_type The type of the asset if the asset name is specified (by default, restricts to IPs & domains). Optional
attribute An attribute value. Optional
cvss_min The minimum CVSS (included). Optional
cvss_max The maximum CVSS (excluded). Optional
limit The maximum number of items to return. Default is 20. Optional
trs_min The minimum TRS (included). Optional
trs_max The maximum TRS (excluded). Optional
vuln_type The vulnerability type (ID). Optional

Context Output

Path Type Description
Hackuity.Vulnerabilities.Attributes String The attributes of the vulnerability
Hackuity.Vulnerabilities.Score.CVSS String The CVSS of the vulnerability
Hackuity.Vulnerabilities.Score.TRS String The TRS of the vulnerability
Hackuity.Vulnerabilities.Description String The description of the vulnerability
Hackuity.Vulnerabilities.ID String The ID of the vulnerability
Hackuity.Vulnerabilities.Seen.First Date The date of the first time the vulnerability has been seen
Hackuity.Vulnerabilities.Findings.Total String The total number of findings on this vulnerability
Hackuity.Vulnerabilities.Findings.Open String The number of open findings on this vulnerability
Hackuity.Vulnerabilities.Findings.Closed String The number of closed findings on this vulnerability
Hackuity.Vulnerabilities.Findings.Ignored String The number of ignored findings on this vulnerability
Hackuity.Vulnerabilities.VulnType.ID String The ID of the vulnerability type
Hackuity.Vulnerabilities.VulnType.Name String The name of the vulnerability type

Command example

!hackuity-search-provider-vulnerabilities asset_name=example.com

Context Example

{
    "Hackuity": {
        "Vulnerabilities": [
            {
                "Attributes": [],
                "Description": "KB4561669: Windows 7 and Windows Server 2008 R2 June 2020 Security Update",
                "Findings": {
                    "Closed": 2,
                    "Ignored": 0,
                    "Open": 8,
                    "Total": 10
                },
                "ID": "hy#asset/NKTVm2RU4606:QHBzm5XEkjIp",
                "Score": {
                    "CVSS": 9,
                    "TRS": 636
                },
                "Seen": {
                    "First": "2021-03-03T07:56:07Z"
                },
                "VulnTypes": [
                    {
                        "ID": "common-vulnerability-exposure",
                        "Name": "Common Vulnerability and Exposure (CVE)"
                    }
                ]
            },
            {
                "Attributes": [],
                "Description": "KB4541500: Windows 7 and Windows Server 2008 R2 March 2020 Security Update",
                "Findings": {
                    "Closed": 1,
                    "Ignored": 0,
                    "Open": 15,
                    "Total": 16
                },
                "ID": "hy#asset/NKTVm2RU4606:rX8JQJaETpoq",
                "Score": {
                    "CVSS": 9,
                    "TRS": 636
                },
                "Seen": {
                    "First": "2021-03-03T07:56:07Z"
                },
                "VulnTypes": [
                    {
                        "ID": "common-vulnerability-exposure",
                        "Name": "Common Vulnerability and Exposure (CVE)"
                    }
                ]
            }
        ]
    }
}

Human Readable Output

Provider vulnerabilities

VulnTypes Description Attributes Score Findings Seen
{‘ID’: ‘common-vulnerability-exposure’, ‘Name’: ‘Common Vulnerability and Exposure (CVE)’} KB4561669: Windows 7 and Windows Server 2008 R2 June 2020 Security Update   CVSS: 9.0
TRS: 636		 Total: 10
Open: 8
Closed: 2
Ignored: 0		 First: 2021-03-03T07:56:07Z
{‘ID’: ‘common-vulnerability-exposure’, ‘Name’: ‘Common Vulnerability and Exposure (CVE)’} KB4541500: Windows 7 and Windows Server 2008 R2 March 2020 Security Update   CVSS: 9.0
TRS: 636		 Total: 16
Open: 15
Closed: 1
Ignored: 0		 First: 2021-03-03T07:56:07Z

hackuity-dashboard-widgets

List the widgets in the default dashboard of the user.

Base Command

hackuity-dashboard-widgets

Input

There are no input arguments for this command.

Context Output

Path Type Description
Hackuity.Dashboard.Widgets.ID String The ID of the widget
Hackuity.Dashboard.Widgets.Params Unknown The configuration of the widget
Hackuity.Dashboard.Widgets.Type String The type of the widget

Command example


#### Context Example

```json
{
    "Hackuity": {
        "Dashboard": {
            "Widgets": [
                {
                    "ID": "abcd3fgh1jklmn0pqrstuv",
                    "Params": {
                        "nbDaysToCompare": 28,
                        "withTotal": true
                    },
                    "Type": "ASSETS_OVERVIEW"
                }
            ]
        }
    }
}

Human Readable Output

Dashboard widgets

ID Type Params
abcd3fgh1jklmn0pqrstuv ASSETS_OVERVIEW nbDaysToCompare: 28
withTotal: true

hackuity-dashboard-data

Get the data of a dashboard widget

Base Command

hackuity-dashboard-data

Input

Argument Name Description Required
widget_id The ID of the widget. Required

Context Output

Path Type Description
Hackuity.Dashboard.Data Unknown The data of the widget

Command example

!hackuity-dashboard-data widget_id=abcd3fgh1jklmn0pqrstuv

Context Example

{
    "Hackuity": {
        "Dashboard": {
            "Data": {
                "abcd3fgh1jklmn0pqrstuv": {
                    "currentNbAssets": 456,
                    "previousNbAssets": 123
                }
            }
        }
    }
}

Human Readable Output

Dashboard widget data (abcd3fgh1jklmn0pqrstuv)

currentNbAssets previousNbAssets
456 123

Configuration parameters

  • url — Corporate server URL (required)
  • namespace — Namespace (required)
  • login — Login (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (5)

  • hackuity-dashboard-data

    Get the data of a dashboard widget.

  • hackuity-dashboard-widgets

    List the widgets in the default dashboard of the user.

  • hackuity-search-findings

    Search for findings in Hackuity.

  • hackuity-search-provider-vulnerabilities

    Search for provider vulnerabilities in Hackuity.

  • hackuity-search-vulndb-vulnerabilities

    Search for vulndb vulnerabilities in Hackuity.

Source

Hackuity.py Hackuity_test.py Hackuity.yml Hackuity_description.md command_examples.txt
Download History Raw 
category: Vulnerability Management
provider: Hackuity
commonfields:
  id: Hackuity
  version: -1
configuration:
- defaultvalue: https://xxx.api.hackuity.io
  display: Corporate server URL
  name: url
  required: true
  type: 0
- defaultvalue: N012345654321
  display: Namespace
  name: namespace
  required: true
  type: 0
- defaultvalue: ""
  display: Login
  name: login
  required: true
  hiddenusername: true
  displaypassword: API Key
  type: 9
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: From a war-room, query your Hackuity cockpit in order to seamlessly retrieve information related to your vulnerability stock.
display: Hackuity
name: Hackuity
script:
  commands:
  - arguments:
    - &argument_asset_name
      description: The name of the asset.
      name: asset_name
    - &argument_asset_type
      description: The type of the asset if the asset name is specified (by default, restricts to IPs & domains).
      name: asset_type
    - &argument_attribute
      description: An attribute value.
      name: attribute
    - &argument_cvss_min
      description: The minimum CVSS (included).
      name: cvss_min
    - &argument_cvss_max
      description: The maximum CVSS (excluded).
      name: cvss_max
    - &argument_limit
      defaultValue: '20'
      description: The maximum number of items to return.
      name: limit
    - &argument_trs_min
      description: The minimum TRS (included).
      name: trs_min
    - &argument_trs_max
      description: The maximum TRS (excluded).
      name: trs_max
    - &argument_vuln_type
      description: The vulnerability type (ID).
      name: vuln_type
    description: Search for findings in Hackuity.
    name: hackuity-search-findings
    outputs:
    - contextPath: Hackuity.Findings.Asset.ID
      description: The ID of the asset.
      type: String
    - contextPath: Hackuity.Findings.Asset.Name
      description: The name of the asset.
      type: String
    - contextPath: Hackuity.Findings.Asset.Type
      description: The type of the asset.
      type: String
    - contextPath: Hackuity.Findings.Attributes
      description: The attributes of the finding.
      type: Unknown
    - contextPath: Hackuity.Findings.Score.CVSS
      description: The CVSS of the finding.
      type: Number
    - contextPath: Hackuity.Findings.Score.TRS
      description: The TRS of the finding.
      type: Number
    - contextPath: Hackuity.Findings.ID
      description: The ID of the finding.
      type: String
    - contextPath: Hackuity.Findings.Status.Ignored
      description: Whether the finding is ignored.
      type: Boolean
    - contextPath: Hackuity.Findings.Status.State
      description: The state of the finding.
      type: String
    - contextPath: Hackuity.Findings.Status.SubState
      description: The sub-state of the finding.
      type: String
    - contextPath: Hackuity.Findings.Status.LastClosedAt
      description: The date of the last time the finding was closed.
      type: Date
    - contextPath: Hackuity.Findings.VulnType.ID
      description: The ID of the vulnerability type.
      type: String
    - contextPath: Hackuity.Findings.VulnType.Name
      description: The name of the vulnerability type.
      type: String
  - arguments:
    - *argument_asset_name
    - *argument_asset_type
    - *argument_attribute
    - *argument_cvss_min
    - *argument_cvss_max
    - *argument_limit
    - *argument_trs_min
    - *argument_trs_max
    - *argument_vuln_type
    description: Search for vulndb vulnerabilities in Hackuity.
    name: hackuity-search-vulndb-vulnerabilities
    outputs: &outputs_vulnerabilities
    - contextPath: Hackuity.Vulnerabilities.Attributes
      description: The attributes of the vulnerability.
      type: String
    - contextPath: Hackuity.Vulnerabilities.Score.CVSS
      description: The CVSS of the vulnerability.
      type: String
    - contextPath: Hackuity.Vulnerabilities.Score.TRS
      description: The TRS of the vulnerability.
      type: String
    - contextPath: Hackuity.Vulnerabilities.Description
      description: The description of the vulnerability.
      type: String
    - contextPath: Hackuity.Vulnerabilities.ID
      description: The ID of the vulnerability.
      type: String
    - contextPath: Hackuity.Vulnerabilities.Seen.First
      description: The date of the first time the vulnerability has been seen.
      type: Date
    - contextPath: Hackuity.Vulnerabilities.Findings.Total
      description: The total number of findings on this vulnerability.
      type: String
    - contextPath: Hackuity.Vulnerabilities.Findings.Open
      description: The number of open findings on this vulnerability.
      type: String
    - contextPath: Hackuity.Vulnerabilities.Findings.Closed
      description: The number of closed findings on this vulnerability.
      type: String
    - contextPath: Hackuity.Vulnerabilities.Findings.Ignored
      description: The number of ignored findings on this vulnerability.
      type: String
    - contextPath: Hackuity.Vulnerabilities.VulnType.ID
      description: The ID of the vulnerability type.
      type: String
    - contextPath: Hackuity.Vulnerabilities.VulnType.Name
      description: The name of the vulnerability type.
      type: String
  - arguments:
    - *argument_asset_name
    - *argument_asset_type
    - *argument_attribute
    - *argument_cvss_min
    - *argument_cvss_max
    - *argument_limit
    - *argument_trs_min
    - *argument_trs_max
    - *argument_vuln_type
    description: Search for provider vulnerabilities in Hackuity.
    name: hackuity-search-provider-vulnerabilities
    outputs: *outputs_vulnerabilities
  - description: List the widgets in the default dashboard of the user.
    name: hackuity-dashboard-widgets
    outputs:
    - contextPath: Hackuity.Dashboard.Widgets.ID
      description: The ID of the widget.
      type: String
    - contextPath: Hackuity.Dashboard.Widgets.Params
      description: The configuration of the widget.
      type: Unknown
    - contextPath: Hackuity.Dashboard.Widgets.Type
      description: The type of the widget.
      type: String
  - arguments:
    - description: The ID of the widget.
      name: widget_id
      required: true
    description: Get the data of a dashboard widget.
    name: hackuity-dashboard-data
    outputs:
    - contextPath: Hackuity.Dashboard.Data
      description: The data of the widget.
      type: Unknown
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.0.0
tests:
- No tests (auto formatted)