Kennav2

Use the Kenna v2 integration to search and update vulnerabilities, schedule a run connector, and manage tags and attributes.
This integration was integrated and tested with version 1.0 of Kenna.

Configure Kenna v2 on Cortex XSOAR

1. Navigate to Settings > Integrations > Instances.
2. Search for Kenna v2.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Required
   Server URL (e.g. https://api.kennasecurity.com)	False
   Kenna API key	False
   Use system proxy settings	False
   Trust any certificate (not secure)	False

4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

kenna-search-vulnerabilities

Searches for vulnerabilities in Kenna.

Base Command

kenna-search-vulnerabilities

Input

Context Output

Command example

!kenna-search-vulnerabilities id=dummy limit=1 to_context=True

Context Example

{
    "Kenna": {
        "Vulnerabilities": {
            "AssetID": "dummy",
            "Connectors": [
                {
                    "DefinitionName": "Dummy XML",
                    "ID": 0,
                    "Name": "Dummy XML",
                    "Vendor": "Dummy"
                },
                {
                    "DefinitionName": "Kenna Data",
                    "ID": 1,
                    "Name": "Generic",
                    "Vendor": "Dummy"
                }
            ],
            "CveID": "CVE-2015-0000",
            "FixID": 00000,
            "ID": 00000,
            "Patch": true,
            "ScannerVulnerabilities": [
                {
                    "ExternalID": "generic scanner-id CVE-2015-0000",
                    "Open": true,
                    "Port": null
                },
                {
                    "ExternalID": "dummy-external-id CVE-2015-0000 0000-0000-0000-0000-0000",
                    "Open": true,
                    "Port": null
                }
            ],
            "Score": 100,
            "Severity": 10,
            "Status": "open",
            "Threat": 10,
            "TopPriority": true
        }
    }
}

Human Readable Output

Kenna Vulnerabilities

Name	Score	id
CVE-2015-0000	100	00000

kenna-run-connector

Executes a run of the specified connector. If file based, it will use the most recently uploaded data file.

Base Command

kenna-run-connector

Input

Context Output

There is no context output for this command.

Command example

!kenna-run-connector id=dummy

Human Readable Output

Connector dummy ran successfully.

kenna-search-fixes

Filters fixes by a given set of vulnerability and asset parameters and returns the filtered fixes.

Base Command

kenna-search-fixes

Input

Context Output

Command example

!kenna-search-fixes limit=2 id=dummy to_context=True

Context Example

{
    "Kenna": {
        "Fixes": {
            "Assets": [
                {
                    "DisplayLocator": "0.0.0",
                    "ID": 0,
                    "Locator": "0.0.0",
                    "PrimaryLocator": "ip_address"
                }
            ],
            "Category": null,
            "CveID": [
                "CVE-2015-0000"
            ],
            "ID": 0,
            "LastUpdatedAt": "2019-10-24T19:13:29.000Z",
            "MaxScore": 100,
            "Title": "CVE-2015-0000",
            "VulnerabilityCount": 1
        }
    }
}

Human Readable Output

CVE-2015-0000

ID: 0

1 vulnerabilities affected

Diagnosis

Related CVE IDs: CVE-2015-0000
 

kenna-update-asset

Updates the attributes of a single asset.

Base Command

kenna-update-asset

Input

Context Output

There is no context output for this command.

Command example

!kenna-update-asset id=dummy notes="New asset info"

Human Readable Output

Asset with ID dummy was successfully updated.

kenna-update-vulnerability

Updates the attributes of a single vulnerability.

Base Command

kenna-update-vulnerability

Input

Context Output

There is no context output for this command.

Command example

!kenna-update-vulnerability id=dummy status=open notes="Test"

Human Readable Output

Asset dummy was updated

kenna-get-connectors

Returns all connectors.

Base Command

kenna-get-connectors

Input

There are no input arguments for this command.

Context Output

Command example

#### Context Example

```json
{
    "Kenna": {
        "ConnectorsList": [
            {
                "Host": null,
                "ID": 0,
                "Name": "XML",
                "Running": false
            },
            {
                "Host": null,
                "ID": 1,
                "Name": "Generic",
                "Running": false
            }
        ]
    }
}

Human Readable Output

Kenna Connectors

Host	ID	Name	Running
	0	XML	false
	1	Generic	false

kenna-search-assets

Searches for assets.

Base Command

kenna-search-assets

Input

Context Output

Command example

!kenna-search-assets limit=2 to_context=True

Context Example

{
    "Kenna": {
        "Assets": [
            {
                "Fqdn": null,
                "Hostname": null,
                "ID": 0,
                "IpAddress": "0.0.0",
                "Notes": "New asset info",
                "OperatingSystem": "Windows",
                "Owner": null,
                "Priority": 10,
                "Score": 1000,
                "Status": "active",
                "Tags": [
                    "Dummy"
                ],
                "VulnerabilitiesCount": 10
            },
            {
                "Fqdn": null,
                "Hostname": null,
                "ID": 1,
                "IpAddress": "0.0.0",
                "Notes": null,
                "OperatingSystem": "Windows",
                "Owner": null,
                "Priority": 10,
                "Score": 1000,
                "Status": "active",
                "Tags": [
                    "Category"
                ],
                "VulnerabilitiesCount": 10
            }
        ]
    }
}

Human Readable Output

Kenna Assets

IP-address	Operating System	Score	id
0.0.0	Windows	1000	0
0.0.0	Windows	1000	1

kenna-get-asset-vulnerabilities

Gets vulnerabilities of the specified asset.

Base Command

kenna-get-asset-vulnerabilities

Input

Context Output

Command example

!kenna-get-asset-vulnerabilities id=dummy limit=2 to_context=True

Context Example

{
    "Kenna": {
        "VulnerabilitiesOfAsset": [
            {
                "AssetID": "dummy",
                "CveID": "CVE-2015-0000",
                "ID": 0,
                "Patch": true,
                "Score": 100,
                "Status": "open",
                "TopPriority": true
            },
            {
                "AssetID": "dummy",
                "CveID": "CVE-2015-0001",
                "ID": 1,
                "Patch": true,
                "Score": 100,
                "Status": "open",
                "TopPriority": true
            }
        ]
    }
}

Human Readable Output

Kenna Vulnerabilities

Name	Score	id
CVE-2015-0000	100	0
CVE-2015-0001	100	1

kenna-add-tag

Adds a tag to the specified asset.

Base Command

kenna-add-tag

Input

Context Output

There is no context output for this command.

Command example

!kenna-add-tag tag="Test tag" id=dummy

Human Readable Output

Tag Test tag was added to asset dummy

kenna-delete-tag

Deletes tags from the specified asset.

Base Command

kenna-delete-tag

Input

Context Output

There is no context output for this command.

Command example

!kenna-delete-tag id=dummy tag="Test tag"

Human Readable Output

Tag Test tag was successfully removed from asset.

kenna-get-connector-runs

Returns JSON data on all the runs of a given connector.

Base Command

kenna-get-connector-runs

Input

Context Output

Command example

!kenna-get-connector-runs connector_id=dummy

Context Example

{
    "Kenna": {
        "ConnectorRunsList": {
            "AssetsWithTagsReset": 0,
            "AutoclosedScannerVulnerabilities": 0,
            "AutoclosedVulnerabilities": 0,
            "ClosedScannerVulnerabilities": 0,
            "ClosedVulnerabilities": 0,
            "CreatedScannerVulnerabilities": 0,
            "EndTime": "2019-10-24T19:13:36.000Z",
            "FailedPayload": 0,
            "ID": 0,
            "ProcessedAssets": 0,
            "ProcessedPayload": null,
            "ProcessedScannerVulnerabilities": 0,
            "ReopenedScannerVulnerabilities": 0,
            "ReopenedVulnerabilities": 0,
            "StartTime": "2019-10-24T19:02:02.000Z",
            "Success": true,
            "TotalPayload": 0,
            "UpdatedScannerVulnerabilities": 0
        }
    }
}

Human Readable Output

Kenna Connector Runs

AssetsWithTagsReset	AutoclosedScannerVulnerabilities	AutoclosedVulnerabilities	ClosedScannerVulnerabilities	ClosedVulnerabilities	CreatedScannerVulnerabilities	EndTime	FailedPayload	ID	ProcessedAssets	ProcessedPayload	ProcessedScannerVulnerabilities	ReopenedScannerVulnerabilities	ReopenedVulnerabilities	StartTime	Success	TotalPayload	UpdatedScannerVulnerabilities
0	0	0	0	0	0	2019-10-24T19:13:36.000Z	0	0	0	0	0	0	0	2019-10-24T19:02:02.000Z	true	0	0

kenna-search-assets-by-external-id

Search assets by external ID.

Base Command

kenna-search-assets-by-external-id

Input

Context Output

Command example

!kenna-search-assets-by-external-id external_id=dummy limit=2 to_context=true

Context Example

{
    "Kenna": {
        "Assets": [
            {
                "Fqdn": null,
                "Hostname": null,
                "ID": 0,
                "IpAddress": "0.0.0",
                "Notes": "New asset info",
                "OperatingSystem": "Windows",
                "Owner": null,
                "Priority": 10,
                "Score": 1000,
                "Status": "active",
                "Tags": [
                    "Category10",
                    "Category9"
                ],
                "VulnerabilitiesCount": 10
            },
            {
                "Fqdn": null,
                "Hostname": null,
                "ID": 1,
                "IpAddress": "0.0.0",
                "Notes": null,
                "OperatingSystem": "Windows",
                "Owner": null,
                "Priority": 10,
                "Score": 1000,
                "Status": "active",
                "Tags": [
                    "Category5",
                    "Category7"
                ],
                "VulnerabilitiesCount": 10
            }
        ]
    }
}

Human Readable Output

Kenna Assets

IP-address	Operating System	Score	id
0.0.0	Windows	1000	0
0.0.0	Windows	1000	0