NodeZero

Integrates with the NodeZero autonomous penetration testing platform to fetch weaknesses discovered during pentest operations. Automatically ingests HIGH and CRITICAL severity weaknesses as incidents for tracking and remediation.

Vulnerability Management · NodeZero

Details

IDNodeZero
ProviderHorizon3.ai
CategoryVulnerability Management
From Version6.1.0
Docker Imagedemisto/py3-tools:1.0.0.10895515
Supported ModulesAgentix XSIAM

README

NodeZero

Integrates with the NodeZero autonomous penetration testing platform to fetch weaknesses discovered during pentest operations. Automatically ingests HIGH and CRITICAL severity weaknesses as incidents for tracking and remediation.

Configure NodeZero on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for NodeZero.
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
Server URL The NodeZero API server URL. True
API Key The API Key required to authenticate to the NodeZero service. True
Trust any certificate (not secure) When selected, certificates are not checked. False
Use system proxy settings Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. False
Fetch incidents When selected, the integration fetches incidents. False
Incident type The incident type to create for fetched incidents. False
Maximum number of weaknesses to fetch Maximum number of incidents to fetch per run. Default is 200. False
First fetch time How far back to fetch on first run (e.g., “7 days”, “3 days”). Default is 7 days. False
Incidents Fetch Interval How often to fetch new incidents (in minutes). Default is 10080 (7 days). False
  1. Click Test to validate the URLs, token, and connection.

Fetch Incidents

The integration fetches HIGH and CRITICAL severity weaknesses from NodeZero pentest operations as incidents. Each weakness is converted to an XSOAR incident with the following mappings:

NodeZero Field XSOAR Incident Field
uuid dbotMirrorId
created_at occurred
severity severity (CRITICAL=4, HIGH=3)
vuln_id externalid
affected_asset_display_name sourcehostname
ip sourceip
score nodezeroweaknessscore
vuln_category nodezeroweaknesscategory
has_proof nodezeroweaknessproven
attack_paths_count nodezeroattackpathscount
vuln_cisa_kev nodezerocisakov
vuln_known_ransomware_campaign_use nodezeroransomwareuse
op_id nodezeroopid

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message is displayed in the War Room with the command details.

nodezero-get-weaknesses

Retrieves HIGH and CRITICAL weaknesses discovered by NodeZero pentests.

Base Command

nodezero-get-weaknesses

Input

Argument Name Description Required
since_date Fetch weaknesses created on or after this date (ISO 8601, e.g. 2024-01-01T00:00:00). Defaults to 7 days ago. Optional
limit Maximum number of weaknesses to return (1–1000). Default is 50. Optional

Context Output

Path Type Description
NodeZero.Weakness.uuid String Unique identifier of the weakness.
NodeZero.Weakness.created_at Date Timestamp when the weakness was first discovered.
NodeZero.Weakness.vuln_id String Vulnerability identifier (e.g. CVE ID).
NodeZero.Weakness.vuln_name String Full vulnerability name.
NodeZero.Weakness.vuln_short_name String Short vulnerability name.
NodeZero.Weakness.vuln_category String Vulnerability category.
NodeZero.Weakness.vuln_cisa_kev Boolean Whether the vulnerability is in the CISA Known Exploited Vulnerabilities catalog.
NodeZero.Weakness.vuln_known_ransomware_campaign_use Boolean Whether the vulnerability is known to be used in ransomware campaigns.
NodeZero.Weakness.ip String IP address of the affected asset.
NodeZero.Weakness.has_proof Boolean Whether NodeZero has proof of exploitability.
NodeZero.Weakness.score Number Weakness severity score.
NodeZero.Weakness.severity String Weakness severity level (HIGH or CRITICAL).
NodeZero.Weakness.affected_asset_uuid String UUID of the affected asset.
NodeZero.Weakness.affected_asset_display_name String Display name of the affected asset.
NodeZero.Weakness.attack_paths_count Number Number of attack paths through this weakness.
NodeZero.Weakness.op_id String ID of the pentest operation that discovered this weakness.

Command example

!nodezero-get-weaknesses limit=5

Human Readable Output

NodeZero Weaknesses

uuid severity vuln_name ip score has_proof
abc-123 CRITICAL Example Vuln 10.0.0.1 9.8 true

Deduplication

The integration uses ID-based deduplication to prevent duplicate incidents:

  • On first run, weaknesses from the last N days (configured via “First fetch time”) are fetched.
  • On subsequent runs, the integration queries weaknesses since the most recent created_at timestamp from the previous fetch.
  • UUIDs of weaknesses at the latest timestamp are tracked to avoid re-fetching them if they appear in the next query window.

This ensures that even if multiple weaknesses share the same timestamp, they are only ingested once.

Known Limitations

  • Only HIGH and CRITICAL severity weaknesses are fetched.
  • The integration uses a GraphQL API with JWT-based authentication.
  • JWT tokens are cached and automatically refreshed before expiration.

Troubleshooting

If you encounter authentication errors, verify that:

  1. The API Key is correct and has not expired.
  2. The Server URL is accessible from the XSOAR server.
  3. SSL certificates are valid (or “Trust any certificate” is enabled for testing).

Configuration parameters

  • url — Server URL (required)
  • credentials — API Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • max_fetch — Maximum number of weaknesses to fetch
  • first_fetch — First fetch time
  • incidentFetchInterval — Incidents Fetch Interval

Commands (1)

  • nodezero-get-weaknesses

    Retrieves HIGH and CRITICAL weaknesses discovered by NodeZero pentests.

Source

NodeZero.py NodeZero_test.py NodeZero.yml NodeZero_description.md command_examples.txt
Download History Raw 
## NodeZero

Integrates with the [NodeZero](https://www.horizon3.ai/nodezero/) autonomous penetration testing platform to fetch weaknesses as XSOAR incidents.

### Obtain an API Key

The API key must have **read** access to pentest operations and weaknesses.

1. Log in to the [Horizon3.ai Portal](https://portal.horizon3ai.com/).
2. Navigate to **Settings** > **My Settings** > **API Keys**.
3. Click **Generate API Key** and copy the key value.
4. Paste the key into the **API Key** parameter when configuring the integration instance.