OpenCVE

Searches for CVE information using OpenCVE.

Vulnerability Management · OpenCVE

Details

IDOpenCVE
ProviderAmber Security SAS
CategoryVulnerability Management
From Version6.9.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Ingests CVEs from an instance of OpenCVE.

Configure OpenCVE in Cortex

Parameter Description Required
Server URL   True
Username   True
Password   True
Source Reliability Reliability of the source providing the intelligence data. True
Trust any certificate (not secure)   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

opencve-latest

Returns the latest updated CVEs from your reports.

Base Command

opencve-latest

Input

Argument Name Description Required
limit The maximum number of CVEs to display. Optional
lastRun Last run. Optional

Context Output

Path Type Description
CVE.ID String The ID of the CVE.
CVE.CVSS number The CVSS score of the CVE.
CVE.Published Date The date the CVE was published.
CVE.Modified Date The date that the CVE was last modified.
CVE.Description String The description of the CVE.
DBotScore.Indicator String The indicator value.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor reporting the score of the indicator.

cve

Returns CVE information by CVE ID.

Base Command

cve

Input

Argument Name Description Required
cve The CVE ID. For example: CVE-2014-1234. Required

Context Output

Path Type Description
CVE.ID String The ID of the CVE.
CVE.CVSS number The CVSS score of the CVE.
CVE.Published Date The date the CVE was published.
CVE.Modified Date The date that the CVE was last modified.
CVE.Description String The description of the CVE.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The indicator score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.

opencve-get-my-vendors

List the vendors subscriptions of the authenticated user.

Base Command

opencve-get-my-vendors

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
OpenCVE.Vendors unknown Vendors.

opencve-get-my-products

List the products subscriptions of the authenticated user.

Base Command

opencve-get-my-products

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
OpenCVE.Products unknown Products.

opencve-get-vendor-cves

Get vendor CVEs.

Base Command

opencve-get-vendor-cves

Input

Argument Name Description Required
vendor_name Vendor name. Required

Context Output

Path Type Description
vendor_cves unknown CVEs for the vendor.

opencve-get-product-cves

Get product CVEs.

Base Command

opencve-get-product-cves

Input

Argument Name Description Required
vendor_name Vendor name. Required
product_name Product name. Required

Context Output

Path Type Description
product_cves unknown Product CVEs.

opencve-get-reports

List the reports of the authenticated user or get a specific report.

Base Command

opencve-get-reports

Input

Argument Name Description Required
report_id Report ID. Optional
page Specific page to start from. Optional

Context Output

Path Type Description
reports unknown Reports.

opencve-get-alerts

List the alerts of a report or get the details of a specific alert.

Base Command

opencve-get-alerts

Input

Argument Name Description Required
report_id The report ID. Optional
page Specific page to start from. Optional
alert_id The Alert ID. Optional

Context Output

Path Type Description
alerts unknown The Alerts from the provided Report ID.

opencve-get-products

List the products associated to a vendor or get a specific one.

Base Command

opencve-get-products

Input

Argument Name Description Required
vendor_name Vendor name. Required
product_name Product name. Optional
search Filter the search by a keyword. Optional
page Specific page to start from. Optional

Context Output

Path Type Description
products unknown Products.

opencve-get-vendors

List the products associated to a vendor or get a specific product of a vendor by specifying its name.

Base Command

opencve-get-vendors

Input

Argument Name Description Required
vendor_name Vendor name. Optional
search Filter the search by a keyword. Optional
page Specific page to start from. Optional
letter Filter by the first letter. Optional

Context Output

Path Type Description
vendors unknown Vendors.

Configuration parameters

  • url — Server URL (required)
  • credentials — Username (required)
  • integration_reliability — Source Reliability (required)
  • insecure — Trust any certificate (not secure)

Commands (10)

  • cve

    Returns CVE information by CVE ID.

  • opencve-get-alerts

    List the alerts of a report or get the details of a specific alert.

  • opencve-get-my-products

    List the products subscriptions of the authenticated user.

  • opencve-get-my-vendors

    List the vendors subscriptions of the authenticated user.

  • opencve-get-product-cves

    Get product CVEs.

  • opencve-get-products

    List the products associated to a vendor or get a specific one.

  • opencve-get-reports

    List the reports of the authenticated user or get a specific report.

  • opencve-get-vendor-cves

    Get vendor CVEs.

  • opencve-get-vendors

    List the products associated to a vendor or get a specific product of a vendor by specifying its name.

  • opencve-latest

    Returns the latest updated CVEs from your reports.

Source

OpenCVE.py OpenCVE_test.py OpenCVE.yml OpenCVE_description.md command_examples.txt
Download History Raw 
category: Vulnerability Management
provider: Amber Security SAS
commonfields:
  id: OpenCVE
  version: -1
configuration:
- defaultvalue: https://www.opencve.io
  display: Server URL
  name: url
  required: true
  type: 0
- display: Username
  displaypassword: Password
  name: credentials
  required: true
  type: 9
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A+ - 3rd party enrichment
  display: Source Reliability
  name: integration_reliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
description: Searches for CVE information using OpenCVE.
display: OpenCVE
name: OpenCVE
script:
  commands:
  - arguments:
    - description: The maximum number of CVEs to display.
      name: limit
    - description: Last run.
      name: lastRun
    description: Returns the latest updated CVEs from your reports.
    name: opencve-latest
    outputs:
    - contextPath: CVE.ID
      description: The ID of the CVE.
      type: String
    - contextPath: CVE.CVSS
      description: The CVSS score of the CVE.
      type: number
    - contextPath: CVE.Published
      description: The date the CVE was published.
      type: Date
    - contextPath: CVE.Modified
      description: The date that the CVE was last modified.
      type: Date
    - contextPath: CVE.Description
      description: The description of the CVE.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator value.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor reporting the score of the indicator.
      type: String
  - arguments:
    - default: true
      description: 'The CVE ID. For example: CVE-2014-1234.'
      isArray: true
      name: cve
      required: true
    description: Returns CVE information by CVE ID.
    name: cve
    outputs:
    - contextPath: CVE.ID
      description: The ID of the CVE.
      type: String
    - contextPath: CVE.CVSS
      description: The CVSS score of the CVE.
      type: number
    - contextPath: CVE.Published
      description: The date the CVE was published.
      type: Date
    - contextPath: CVE.Modified
      description: The date that the CVE was last modified.
      type: Date
    - contextPath: CVE.Description
      description: The description of the CVE.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
  - arguments: []
    description: List the vendors subscriptions of the authenticated user.
    name: opencve-get-my-vendors
    outputs:
    - contextPath: OpenCVE.Vendors
      description: Vendors.
  - arguments: []
    description: List the products subscriptions of the authenticated user.
    name: opencve-get-my-products
    outputs:
    - contextPath: OpenCVE.Products
      description: Products.
  - arguments:
    - description: Vendor name.
      name: vendor_name
      required: true
    description: Get vendor CVEs.
    name: opencve-get-vendor-cves
    outputs:
    - contextPath: vendor_cves
      description: CVEs for the vendor.
  - arguments:
    - description: Vendor name.
      name: vendor_name
      required: true
    - description: Product name.
      name: product_name
      required: true
    description: Get product CVEs.
    name: opencve-get-product-cves
    outputs:
    - contextPath: product_cves
      description: Product CVEs.
  - arguments:
    - description: Report ID.
      name: report_id
      required: false
    - description: Specific page to start from.
      name: page
      required: false
    description: List the reports of the authenticated user or get a specific report.
    name: opencve-get-reports
    outputs:
    - contextPath: reports
      description: Reports.
  - arguments:
    - description: The report ID.
      name: report_id
      required: false
    - description: Specific page to start from.
      name: page
      required: false
    - description: The Alert ID.
      name: alert_id
      required: false
    description: List the alerts of a report or get the details of a specific alert.
    name: opencve-get-alerts
    outputs:
    - contextPath: alerts
      description: The Alerts from the provided Report ID.
  - arguments:
    - description: Vendor name.
      name: vendor_name
      required: true
    - description: Product name.
      name: product_name
      required: false
    - description: Filter the search by a keyword.
      name: search
      required: false
    - description: Specific page to start from.
      name: page
      required: false
    description: List the products associated to a vendor or get a specific one.
    name: opencve-get-products
    outputs:
    - contextPath: products
      description: Products.
  - arguments:
    - description: Vendor name.
      name: vendor_name
      required: false
    - description: Filter the search by a keyword.
      name: search
      required: false
    - description: Specific page to start from.
      name: page
      required: false
    - description: Filter by the first letter.
      name: letter
      required: false
    description: List the products associated to a vendor or get a specific product of a vendor by specifying its name.
    name: opencve-get-vendors
    outputs:
    - contextPath: vendors
      description: Vendors.
  dockerimage: demisto/python3:3.12.13.10116658
  feed: false
  isFetchSamples: true
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.9.0
tests:
- No tests (auto formatted)