National Vulnerability Database

commonfields:
  id: National Vulnerability Database
  version: -1
name: National Vulnerability Database
display: National Vulnerability Database
category: Data Enrichment & Threat Intelligence
provider: NIST
description: CVE feed from the National Vulnerability Database.
detaileddescription: >-
  ## National Vunerability Database Feed

  ### Overview
  The Common Vulnerabilities and Exposures (CVE) program is a dictionary or glossary
  of vulnerabilities that have been identified for specific code bases, such as software
  applications or open libraries. A unique identifier known as the CVE ID allows stakeholders
  a common means of discussing and researching a specific, unique exploit. The Common
  Platform Enumeration (CPE) program fulfills a function similar to the CVE program
  for IT products and platforms. The Security Content Automation Protocol (SCAP) program
  combines CVE and CPE in a suite of tools to help automate vulnerability management
  and evaluate compliance with federal information technology security requirements.

  The NVD maintains the authoritative CPE dictionary, while the CVE program is maintained
  by the MITRE corporation. Both programs are sponsored by the U.S. Department of
  Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency
  (CISA). The National Vulnerability Database (NVD) is tasked with analyzing each
  CVE once it has been published to the CVE List. NVD analysts use the reference information
  provided with the CVE and any publicly available information at the time of analysis
  to associate Reference Tags, Common Vulnerability Scoring System (CVSS) v2.0, CVSS
  v3.1, CWE, and CPE Applicability statements.

  CVEs are typically available in the NVD within an hour of their publishing. Once
  a CVE is in the NVD, analysts can begin the analysis process. The processing time
  can vary depending on the CVE, the information available, and the quantity of CVEs
  published within a given timeframe. After analysis is provided, CVEs may be updated
  (modified). If modifications are available, the NVD publishes these updates once
  every two hours. The CPE Dictionary is updated nightly when modifications or new
  names are added.

  ### Request an API Key
  Navigate to https://nvd.nist.gov/developers/request-an-api-key
  On the API key requests page, enter data into the three fields on the requests form.
  Scroll to the bottom of the Terms of Use, and then click the check box marked “I
  agree to the Terms of Use.”
  Check the inbox of the email address provided in the steps above for an email from
  nvd-noreply@nist.gov.
  Activate and view the API Key by opening the single-use hyperlink. Store the API
  Key in a secure location as the page will no longer be available after it is closed.
  If your key is not activated within seven days, a request for a new API Key must
  be submitted.
  Each API Key is associated with a single email address. If an email address is used
  to request an additional API key, clicking the single-use hyperlink will invalidate
  the key previously associated with that email address.  The key will not be invalidated
  if the email is used to request another key, but the link is not opened. There is
  no process for retrieving a forgotten key.

  ### Rate Limits
  Requesting an API key allows for users to make a greater number of requests in a
  given time than they could otherwise. The public rate limit (without an API key)
  is 10 requests in a rolling 60 second window; the rate limit with an API key is
  100 requests in a rolling 60 second window.

  ---
configuration:
- name: apiKey
  display: API Key
  type: 4
  required: false
- name: type
  display: Feed Type
  required: true
  defaultvalue: CVE
  type: 15
  additionalinfo:
  options:
  - CVE
- name: cpeMatchString
  display: CPE Match String
  type: 0
  additionalinfo: "Filter CVEs based on the affected products. For example: cpe:2.3:o:microsoft:windows_10 to match all Windows 10. cpe:2.3:*:microsoft for all Microsoft"
  required: false
- name: keyword
  display: Keyword
  type: 0
  additionalinfo: Retrieve CVEs where a word or phrase is found in the CPE title or reference links.
  required: false
- name: cvssV2Metrics
  display: CVSS V2 Metrics
  type: 0
  additionalinfo: Filter CVEs based on CVSS V2 vector strings. See https://nvd.nist.gov/developers/vulnerabilities for more information.
  required: false
- name: cvssV2Severity
  display: CVSS V2 Severity
  defaultvalue: ''
  type: 15
  additionalinfo: Filter CVEs based on their CVSS V2 Severity rating.
  options:
  - LOW
  - MEDIUM
  - HIGH
  required: false
- name: cvssV3Metrics
  display: CVSS V3 Metrics
  type: 0
  additionalinfo: Filter CVEs based on CVSS V3 vector strings. See https://nvd.nist.gov/developers/vulnerabilities for more information.
  required: false
- name: cvssV3Severity
  display: CVSS V3 Severity
  defaultvalue: ''
  type: 15
  additionalinfo: Filter CVEs based on their CVSS V3 Severity rating.
  options:
  - LOW
  - MEDIUM
  - HIGH
  - CRITICAL
  required: false
- name: history
  display: History
  defaultvalue: "90"
  type: 0
  additionalinfo: How many days in history to go back and collect.
  required: false
- name: insecure
  display: Trust any certificate (not secure)
  type: 8
  additionalinfo:
  required: false
- name: proxy
  display: Use system proxy settings
  type: 8
  additionalinfo:
  required: false
- name: feed
  display: Fetch indicators
  defaultvalue: 'true'
  type: 8
  required: false
- additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. The determination if the indicator is new or modified happens on the 3rd-party vendor's side, so only indicators that are new or modified are sent to Cortex XSOAR. Therefore, all indicators coming from these feeds are labeled new or modified.
  defaultvalue: 'true'
  display: Incremental feed
  hidden: true
  name: feedIncremental
  type: 8
  required: false
- name: feedReputation
  additionalinfo: Indicators from this integration instance will be marked with this reputation
  display: Indicator Reputation
  type: 18
  options:
  - None
  - Good
  - Suspicious
  - Bad
  required: false
- name: feedReliability
  display: Source Reliability
  required: true
  defaultvalue: F - Reliability cannot be judged
  type: 15
  additionalinfo: Reliability of the source providing the intelligence data
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
- name: feedExpirationPolicy
  display: ''
  type: 17
  options:
  - never
  - interval
  - indicatorType
  required: false
- name: feedFetchInterval
  display: Feed Fetch Interval
  type: 19
  required: false
- name: feedExpirationInterval
  display: ''
  type: 1
  required: false
- name: feedBypassExclusionList
  display: Bypass exclusion list
  defaultvalue: "true"
  type: 8
  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  required: false
- name: feedTags
  display: Tags
  type: 0
  additionalinfo: Supports CSV values.
  required: false
- name: tlp_color
  display: Traffic Light Protocol Color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  required: false
script:
  script: ""
  type: python
  commands:
  - name: nvd-get-indicators
    arguments: []
    description: Retrieves CVEs from NVD.
    outputs:
    - contextPath: CPE.cpe23Uril
      description: This element identifies a CPE by the CPE 2.3 Naming specification.
      type: String
    - contextPath: CPE.titles
      description: This element contains the human-readable, English title for the CPE.
      type: Unknown
  dockerimage: demisto/python3:3.12.8.3296088
  feed: true
  subtype: python3
  isFetchSamples: true
fromversion: 6.0.0
tests:
- No tests (auto formatted)