RiskSense
RiskSense is a cloud-based platform that provides vulnerability management and prioritization to measure and control cybersecurity risk.
Vulnerability Management · RiskSense
Details
| ID | RiskSense |
|---|---|
| Provider | Ivanti |
| Category | Vulnerability Management |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security |
README
Overview
RiskSense is a cloud-based platform that provides vulnerability management and prioritization to measure and control cybersecurity risk.
Use Cases
The SOAR market is still an emerging market and is often used as an umbrella term that covers security operations, security incident response and threat intelligence. Many vendors, even market leaders like Splunk, are adding features and functionality to their existing solutions in the fight for market leadership. One major commonality between new SOAR vendors and vendors trying to make their existing solution fit into this market definition is the need to be able to ingest security centric data including threat intelligence to address the biggest use-case for SOAR i.e. security operations.
Gartner claims that organizations need to have a continuous adaptive risk and trust assessment (CARTA) strategy to make their investments in SOAR technology pay off. CARTA’s value is that it is continuous, and one element helps and informs other elements, allowing for continuous improvement in your organization’s ability to improve both security posture and digital resilience.
Configure RiskSense on Cortex XSOAR
- Navigate to Settings > Integrations > Servers & Services.
- Search for RiskSense.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- URL
- API Key
- Client Name
- HTTP Request Timeout (Specify the time interval in seconds. All the RiskSense API calls would timeout if the response is not returned within the configured time interval).
- Trust any certificate (not secure)
- Use system proxy settings
- Click Test to validate the URLs, token, and connection.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
- risksense-get-hosts
- risksense-get-host-detail
- risksense-get-unique-cves
- risksense-get-unique-open-findings
- risksense-get-host-findings
- risksense-get-apps
- risksense-get-host-finding-detail
- risksense-get-app-detail
1. risksense-get-hosts
Gets details of the supplied host. The host details can be searched based on input parameters like fieldname (Host Name, IP Address, Criticality, etc), operator (EXACT, IN, LIKE, BETWEEN), page, size, sort by and sort direction.
Base Command
risksense-get-hosts
Input
| Argument Name | Description | Required |
|---|---|---|
| fieldname | The RiskSense host attribute by which to filter the results. Can be ‘Host Name’, ‘IP Address’, or ‘Criticality’. Apart from the available choices, you can provide the attributes supported by RiskSense API. Refer to the API /host/filter API to get the list of supported attributes. The uid of filter attributes must be provided here, for example, assessment_labels, asset_tags, cvss3BaseI, etc. If specified, ‘value’ argument is mandatory. | Optional |
| operator | The match operator should be applied for filtering the hosts based on ‘fieldname’ and ‘value’. Can be ‘EXACT’ - filter records exactly matching the criteria; ‘IN’ - filter records matching any one of the comma-separated values; ‘LIKE’ - filter records with the value matching the specified pattern. All the records fieldname value contains the string provided in value; ‘BETWEEN’ - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. | Optional |
| exclude | The exclude flag that determines whether the returned records matches filter criteria or not. The default set is false. If set to True, host not matching the specified values are fetched. | Optional |
| value | The value of the host property mentioned in ‘fieldname’ to be considered for filter criteria. | Optional |
| page | The index of the page. The index is a numeric value starting with 0. | Optional |
| size | The maximum number of records to fetch in one page. | Optional |
| sort_by | The fieldname by which to sort the returned records. | Optional |
| sort_direction | The sorting direction to apply to returned records. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Host.Hostname | String | The hostname of the host. |
| Host.ID | String | The unique ID within the tool retrieving the host. |
| Host.IP | String | The IP address of the host. |
| Host.OS | String | The operating system of the host. |
| RiskSense.Host.ID | Number | The unique identifier of the host. |
| RiskSense.Host.ClientID | Number | The client id of the host. |
| RiskSense.Host.GroupID | Number | The ID of the group belonging to the host. |
| RiskSense.Host.GroupName | String | The name of the group belonging to the host. |
| RiskSense.Host.Group.ID | Number | The ID of the group belonging to the host. |
| RiskSense.Host.Group.Name | String | The name of the group belonging to the host. |
| RiskSense.Host.Rs3 | Number | The asset security score calculated by the RiskSense platform (includes vulnerability risk on related web applications). |
| RiskSense.Host.Xrs3 | String | The asset security score calculated by the RiskSense platform (includes vulnerability risk on related web applications). |
| RiskSense.Host.Criticality | Number | The asset importance using a scale of 1 (lowest importance) to 5 (highest importance). |
| RiskSense.Host.Tag.ID | Number | The ID of the tag. |
| RiskSense.Host.Tag.Name | String | The name of the tag. |
| RiskSense.Host.Tag.Category | String | The category of the tag. |
| RiskSense.Host.Tag.Description | String | The description of the tag. |
| RiskSense.Host.Tag.Created | String | The time when the tag was created. |
| RiskSense.Host.Tag.Updated | String | The time when the tag was last updated. |
| RiskSense.Host.Tag.Color | String | The color code of the tag. |
| RiskSense.Host.NetworkID | Number | The Network ID of the host. |
| RiskSense.Host.NetworkName | String | The name of the network used by the host. |
| RiskSense.Host.NetworkType | String | The type of the network used by the host. |
| RiskSense.Host.DiscoveredOn | String | The time when the host was discovered. |
| RiskSense.Host.LastFoundOn | String | The time when the host was last found. |
| RiskSense.Host.LastScanTime | String | The last time when the host was last scanned. |
| RiskSense.Host.HostName | String | The hostname of the host. |
| RiskSense.Host.IpAddress | String | The IP address of the host. |
| RiskSense.Host.PortNumbers | String | The list of ports that are currently bound. |
| RiskSense.Host.OS.Name | String | The operating system of the host. |
| RiskSense.Host.OS.Family | String | The family of the operating system of the host. |
| RiskSense.Host.OS.Class | String | The class of the operating system of the host. |
| RiskSense.Host.OS.Vendor | String | The vendor information of the operating system of the host. |
| RiskSense.Host.CMDB.Order | Number | The CMDB order number of the host. |
| RiskSense.Host.CMDB.Key | String | The CMDB key identifier of the host. |
| RiskSense.Host.CMDB.Value | String | The CMDB value identifier of the host. |
| RiskSense.Host.CMDB.Label | String | The CMDB label identifier of the host. |
| RiskSense.Host.Services | String | The name of the services which are used by the host. |
| RiskSense.Host.Note.UserID | String | The User ID of the user who added a note for the host. |
| RiskSense.Host.Note.UserName | String | The username of the user who added a note for the host. |
| RiskSense.Host.Note.Note | String | The notes that are added by the user for the host. |
| RiskSense.Host.Note.Date | String | The time when the note was added by the user for the host. |
| RiskSense.Host.Source.Name | String | The name of the source associated with the host. |
| RiskSense.Host.Source.UuID | String | The unique ID of the source associated with the host. |
| RiskSense.Host.Source.ScannerType | String | The type of scanner that discovered the host. |
| RiskSense.Host.Ticket.TicketNumber | String | The number of the ticket associated with the host. |
| RiskSense.Host.Ticket.TicketStatus | String | The status of the ticket associated with the host. |
| RiskSense.Host.Ticket.DeepLink | String | The deeplink associated with the ticket associated with the host. |
| RiskSense.Host.Ticket.Type | String | The type of the ticket associated with the host. |
| RiskSense.Host.Ticket.ConnectorName | String | The connector name of the ticket associated with the host. |
| RiskSense.Host.Ticket.DetailedStatus | String | The detailed status of the ticket associated with the host. |
| RiskSense.Host.LastVulnTrendingOn | String | The time when the last vulnerability was trending on the host. |
| RiskSense.Host.LastThreatTrendingOn | String | The time when the last threat was trending on the host. |
| RiskSense.Host.OldestOpenFindingWithThreatDiscoveredOn | String | The timestamp when the oldest open finding with the threat was discovered. |
| RiskSense.Host.Xrs3date | String | The time when the xrs3 is calculated by RiskSense platform. |
| RiskSense.Host.DiscoveredByRS | String | The flag that determines whether the host is discovered by the RiskSense platform or not. |
| RiskSense.Host.Href | String | The deeplink pointing to the host details on RiskSense. |
| RiskSense.Host.Total | Number | The number of total open findings of the host. |
| RiskSense.Host.Critical | Number | The number of open findings of the host with critical severity. |
| RiskSense.Host.High | Number | The number of open findings of the host with high severity. |
| RiskSense.Host.Medium | Number | The number of open findings of the host with medium severity. |
| RiskSense.Host.Low | Number | The number of open findings of the host with low severity. |
| RiskSense.Host.Info | Number | The number of open findings of the host with info severity. |
| Ticket.ID | String | The ID of the ticket associated with the host. |
| Ticket.State | String | The state of the ticket associated with the host. |
Command Example
!risksense-get-hosts fieldname="Criticality" value="5" page="0" size="2" sort_by="Total Findings" sort_direction="Descending"
Context Example
{
"RiskSense.Host": [
{
"OldestOpenFindingWithThreatDiscoveredOn": "2017-09-14",
"HostName": "iz0.y2.gov",
"Group": [
{
"ID": 7990,
"Name": "Default Group"
}
],
"Note": [],
"Source": [
{
"ScannerType": null,
"Name": "QUALYS",
"UuID": "QUALYS_SCANNER"
}
],
"Critical": 48,
"Low": 34,
"IpAddress": "45.19.214.161",
"Xrs3": null,
"Medium": 209,
"Criticality": 5,
"LastVulnTrendingOn": "2020-03-15",
"ClientID": 747,
"GroupID": 7990,
"Xrs3date": null,
"DiscoveredByRS": false,
"Tag": [
{
"Category": "PEOPLE",
"Updated": "2019-04-24T21:39:59",
"Name": "Linux_Team_2",
"Created": "2019-04-24T21:39:59",
"Color": "#78a19b",
"ID": 215554,
"Description": ""
},
{
"Category": "LOCATION",
"Updated": "2019-04-24T21:37:06",
"Name": "Data_Center_2",
"Created": "2019-04-24T21:37:06",
"Color": "#dd8361",
"ID": 215552,
"Description": ""
}
],
"Services": "ssh, telnet, ftp",
"Ticket": [],
"NetworkID": 78038,
"Info": 0,
"DiscoveredOn": "2007-06-14",
"PortNumbers": "22, 21, 23",
"LastScanTime": "2007-06-14T21:14:04",
"GroupName": "Default Group",
"ID": 3570259,
"CMDB": [
{
"Value": "",
"Order": 1,
"Key": "busines_criticality",
"Label": "Asset Criticality"
},
{
"Value": "",
"Order": 2,
"Key": "os",
"Label": "Operating System"
},
{
"Value": "",
"Order": 3,
"Key": "manufacturer",
"Label": "Manufactured By"
},
{
"Value": "",
"Order": 4,
"Key": "model_id",
"Label": "Model"
},
{
"Value": "",
"Order": 5,
"Key": "location",
"Label": "Location"
},
{
"Value": "",
"Order": 6,
"Key": "managed_by",
"Label": "Managed By"
},
{
"Value": "",
"Order": 7,
"Key": "owned_by",
"Label": "Owned By"
},
{
"Value": "",
"Order": 8,
"Key": "supported_by",
"Label": "Supported By"
},
{
"Value": "",
"Order": 9,
"Key": "support_group",
"Label": "Support Group"
},
{
"Value": "",
"Order": 10,
"Key": "sys_updated_on",
"Label": "Last Scanned"
},
{
"Value": "",
"Order": 11,
"Key": "asset_tag",
"Label": "Asset tags"
},
{
"Value": "",
"Order": 12,
"Key": "mac_address",
"Label": "Mac Address"
},
{
"Value": "",
"Order": 16,
"Key": "sys_id",
"Label": "Unique Id"
},
{
"Value": "",
"Order": 18,
"Key": "cf_1",
"Label": "Mike Name 1"
},
{
"Value": "",
"Order": 19,
"Key": "cf_2",
"Label": "Custom Field 2"
},
{
"Value": "",
"Order": 20,
"Key": "cf_3",
"Label": "Custom Field 3"
},
{
"Value": "",
"Order": 21,
"Key": "cf_4",
"Label": "Custom Field 4"
},
{
"Value": "",
"Order": 22,
"Key": "cf_5",
"Label": "Custom Field 5"
},
{
"Value": "",
"Order": 23,
"Key": "cf_6",
"Label": "Custom Field 6"
},
{
"Value": "",
"Order": 24,
"Key": "cf_7",
"Label": "Custom Field 7"
},
{
"Value": "",
"Order": 25,
"Key": "cf_8",
"Label": "Custom Field 8"
},
{
"Value": "",
"Order": 26,
"Key": "cf_9",
"Label": "Custom Field 9"
},
{
"Value": "",
"Order": 29,
"Key": "cf_10",
"Label": "Custom Field 10"
},
{
"Value": "",
"Order": 13,
"Key": "Asset Compliance",
"Label": "Asset Compliance"
}
],
"LastThreatTrendingOn": "2020-03-15",
"OS": {
"Vendor": "Red Hat",
"Class": "Not Reported",
"Family": "Linux",
"Name": "Red Hat Enterprise Linux Server 6.1"
},
"High": 127,
"Href": "http://platform.risksense.com/api/v1/client/747/host/search?page=0&size=2&sort=findingsDistribution.total,desc",
"LastFoundOn": "2019-04-23",
"NetworkType": "IP",
"Total": 418,
"NetworkName": "IP Network",
"Rs3": 513
},
{
"OldestOpenFindingWithThreatDiscoveredOn": "2015-02-10",
"HostName": "ftpserver",
"Group": [
{
"ID": 7990,
"Name": "Default Group"
}
],
"Note": [],
"Source": [
{
"ScannerType": null,
"Name": "QUALYS",
"UuID": "QUALYS_SCANNER"
}
],
"Critical": 23,
"Low": 49,
"IpAddress": "34.17.197.127",
"Xrs3": null,
"Medium": 141,
"Criticality": 5,
"LastVulnTrendingOn": "2020-02-23",
"ClientID": 747,
"GroupID": 7990,
"Xrs3date": null,
"DiscoveredByRS": false,
"Tag": [
{
"Category": "PEOPLE",
"Updated": "2019-04-24T21:39:59",
"Name": "Linux_Team_2",
"Created": "2019-04-24T21:39:59",
"Color": "#78a19b",
"ID": 215554,
"Description": ""
},
{
"Category": "LOCATION",
"Updated": "2019-04-24T21:37:06",
"Name": "Data_Center_2",
"Created": "2019-04-24T21:37:06",
"Color": "#dd8361",
"ID": 215552,
"Description": ""
}
],
"Services": "ssh, ftps, unknown, ftp, unknown, unknown, unknown",
"Ticket": [],
"NetworkID": 78038,
"Info": 0,
"DiscoveredOn": "2006-12-06",
"PortNumbers": "990, 80, 55443, 22, 65443, 443",
"LastScanTime": "2006-12-06T17:08:05",
"GroupName": "Default Group",
"ID": 3571622,
"CMDB": [
{
"Value": "",
"Order": 1,
"Key": "busines_criticality",
"Label": "Asset Criticality"
},
{
"Value": "",
"Order": 2,
"Key": "os",
"Label": "Operating System"
},
{
"Value": "",
"Order": 3,
"Key": "manufacturer",
"Label": "Manufactured By"
},
{
"Value": "",
"Order": 4,
"Key": "model_id",
"Label": "Model"
},
{
"Value": "",
"Order": 5,
"Key": "location",
"Label": "Location"
},
{
"Value": "",
"Order": 6,
"Key": "managed_by",
"Label": "Managed By"
},
{
"Value": "",
"Order": 7,
"Key": "owned_by",
"Label": "Owned By"
},
{
"Value": "",
"Order": 8,
"Key": "supported_by",
"Label": "Supported By"
},
{
"Value": "",
"Order": 9,
"Key": "support_group",
"Label": "Support Group"
},
{
"Value": "",
"Order": 10,
"Key": "sys_updated_on",
"Label": "Last Scanned"
},
{
"Value": "",
"Order": 11,
"Key": "asset_tag",
"Label": "Asset tags"
},
{
"Value": "",
"Order": 12,
"Key": "mac_address",
"Label": "Mac Address"
},
{
"Value": "",
"Order": 16,
"Key": "sys_id",
"Label": "Unique Id"
},
{
"Value": "",
"Order": 18,
"Key": "cf_1",
"Label": "Mike Name 1"
},
{
"Value": "",
"Order": 19,
"Key": "cf_2",
"Label": "Custom Field 2"
},
{
"Value": "",
"Order": 20,
"Key": "cf_3",
"Label": "Custom Field 3"
},
{
"Value": "",
"Order": 21,
"Key": "cf_4",
"Label": "Custom Field 4"
},
{
"Value": "",
"Order": 22,
"Key": "cf_5",
"Label": "Custom Field 5"
},
{
"Value": "",
"Order": 23,
"Key": "cf_6",
"Label": "Custom Field 6"
},
{
"Value": "",
"Order": 24,
"Key": "cf_7",
"Label": "Custom Field 7"
},
{
"Value": "",
"Order": 25,
"Key": "cf_8",
"Label": "Custom Field 8"
},
{
"Value": "",
"Order": 26,
"Key": "cf_9",
"Label": "Custom Field 9"
},
{
"Value": "",
"Order": 29,
"Key": "cf_10",
"Label": "Custom Field 10"
},
{
"Value": "",
"Order": 13,
"Key": "Asset Compliance",
"Label": "Asset Compliance"
}
],
"LastThreatTrendingOn": "2020-02-23",
"OS": {
"Vendor": "Red Hat",
"Class": "Not Reported",
"Family": "Linux",
"Name": "Red Hat Enterprise Linux Server 5.4"
},
"High": 78,
"Href": "http://platform.risksense.com/api/v1/client/747/host/search?page=0&size=2&sort=findingsDistribution.total,desc",
"LastFoundOn": "2019-04-23",
"NetworkType": "IP",
"Total": 291,
"NetworkName": "IP Network",
"Rs3": 528
}
],
"Host": [
{
"IP": "45.19.214.161",
"Hostname": "iz0.y2.gov",
"OS": "Red Hat Enterprise Linux Server 6.1",
"ID": 3570259
},
{
"IP": "34.17.197.127",
"Hostname": "ftpserver",
"OS": "Red Hat Enterprise Linux Server 5.4",
"ID": 3571622
}
]
}
Human Readable Output
Total hosts found: 1969 Page: 0/984 Client: The Demo Client
RiskSense host(s) details
| RS3 | Host Name | Total Findings | Critical Findings | High Findings | Medium Findings | Low Findings | Info Findings | ID | OS | Tags | Notes | Criticality | IP Address | Network | Group |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 513 | iz0.y2.gov | 418 | 48 | 127 | 209 | 34 | 0 | 3570259 | Red Hat Enterprise Linux Server 6.1 | 2 | 0 | 5 | 45.19.214.161 | IP Network | 1 |
| 528 | ftpserver | 291 | 23 | 78 | 141 | 49 | 0 | 3571622 | Red Hat Enterprise Linux Server 5.4 | 2 | 0 | 5 | 34.17.197.127 | IP Network | 1 |
2. risksense-get-host-detail
Gets in-depth details of a single host. This command accepts either hostname or host ID as an argument.
Base Command
risksense-get-host-detail
Input
| Argument Name | Description | Required |
|---|---|---|
| host_id | The unique host ID of the host. The host ID is either known by RiskSense users or it can be searched in context output (RiskSense.Host.ID) or in the human-readable output of ‘risksense-get-hosts’ command. | Optional |
| host | The hostname of the host. The hostname is either known by RiskSense users or it can be searched in context output (RiskSense.Host.HostName) or in the human-readable output of ‘risksense-get-hosts’ command. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Host.Hostname | String | The hostname of the host. |
| Host.ID | String | The unique ID within the tool retrieving the host. |
| Host.IP | String | The IP address of the host. |
| Host.OS | String | The operating system of the host. |
| RiskSense.Host.ID | Number | The unique identifier of the host. |
| RiskSense.Host.ClientID | Number | The client ID of the host. |
| RiskSense.Host.GroupID | Number | The ID of the group belonging to the host. |
| RiskSense.Host.GroupName | String | The name of the group belonging to the host. |
| RiskSense.Host.Group.ID | Number | The ID of the group belonging to the host. |
| RiskSense.Host.Group.Name | String | The name of the group belonging to the host. |
| RiskSense.Host.Rs3 | Number | The asset security score calculated by the RiskSense platform (includes vulnerability risk on related web applications). |
| RiskSense.Host.Xrs3 | String | The asset security score calculated by RiskSense platform. |
| RiskSense.Host.Criticality | Number | The asset importance using a scale of 1 (lowest importance) to 5 (highest importance). |
| RiskSense.Host.Tag.ID | Number | The ID of the tag. |
| RiskSense.Host.Tag.Name | String | The name of the tag. |
| RiskSense.Host.Tag.Category | String | The category of the tag. |
| RiskSense.Host.Tag.Description | String | The description of the tag. |
| RiskSense.Host.Tag.Created | String | The time when the tag was created. |
| RiskSense.Host.Tag.Updated | String | The time when the tag was last updated. |
| RiskSense.Host.Tag.Color | String | The color code of the tag. |
| RiskSense.Host.NetworkID | Number | The network ID of the host. |
| RiskSense.Host.NetworkName | String | The name of the network used by the host. |
| RiskSense.Host.NetworkType | String | The type of the network used by the host. |
| RiskSense.Host.DiscoveredOn | String | The time when the host was discovered. |
| RiskSense.Host.LastFoundOn | String | The time when the host was last found. |
| RiskSense.Host.LastScanTime | String | The last time when the host was last scanned. |
| RiskSense.Host.HostName | String | The hostname of the host. |
| RiskSense.Host.IpAddress | String | The IP address of the host. |
| RiskSense.Host.PortNumbers | String | The list of ports that are currently bound. |
| RiskSense.Host.OS.Name | String | The operating system of the host. |
| RiskSense.Host.OS.Family | String | The family of the operating system of the host. |
| RiskSense.Host.OS.Class | String | The class of the operating system of the host. |
| RiskSense.Host.OS.Vendor | String | The vendor information of the operating system of the host. |
| RiskSense.Host.CMDB.Order | Number | The CMDB order number of the host. |
| RiskSense.Host.CMDB.Key | String | The CMDB key identifier of the host. |
| RiskSense.Host.CMDB.Value | String | The CMDB value identifier of the host. |
| RiskSense.Host.CMDB.Label | String | The CMDB label identifier of the host. |
| RiskSense.Host.Services | String | The name of the services which are used by the host. |
| RiskSense.Host.Note.UserID | String | The User ID of the user who added a note for the host. |
| RiskSense.Host.Note.UserName | String | The username of the user who added a note for the host. |
| RiskSense.Host.Note.Note | String | The notes that are added by the user for the host. |
| RiskSense.Host.Note.Date | String | The time when the note was added by the user for the host. |
| RiskSense.Host.Source.Name | String | The name of the source associated with the host. |
| RiskSense.Host.Source.UuID | String | The unique ID of the source associated with the host. |
| RiskSense.Host.Source.ScannerType | String | The type of scanner that discovered the host. |
| RiskSense.Host.Ticket.TicketNumber | String | The number of the ticket associated with the host. |
| RiskSense.Host.Ticket.TicketStatus | String | The status of the ticket associated with the host. |
| RiskSense.Host.Ticket.DeepLink | String | The deeplink of the ticket associated with the host. |
| RiskSense.Host.Ticket.Type | String | The type of the ticket associated with the host. |
| RiskSense.Host.Ticket.ConnectorName | String | The connector name of the ticket associated with the host. |
| RiskSense.Host.Ticket.DetailedStatus | String | The detailed status of the ticket associated with the host. |
| RiskSense.Host.LastVulnTrendingOn | String | The time when the last vulnerability was trending on the host. |
| RiskSense.Host.LastThreatTrendingOn | String | The time when the last threat was trending on the host. |
| RiskSense.Host.OldestOpenFindingWithThreatDiscoveredOn | String | The timestamp when the oldest open finding with the threat was discovered. |
| RiskSense.Host.Xrs3date | String | The time when the xrs3 is calculated by RiskSense platform. |
| RiskSense.Host.DiscoveredByRS | String | The flag that determines whether the host is discovered by the RiskSense platform or not. |
| RiskSense.Host.Href | String | The deeplink pointing to the host details on RiskSense. |
| RiskSense.Host.Total | Number | The number of total open findings of the host. |
| RiskSense.Host.Critical | Number | The number of open findings of the host with critical severity. |
| RiskSense.Host.High | Number | The number of open findings of the host with high severity. |
| RiskSense.Host.Medium | Number | The number of open findings of the host with medium severity. |
| RiskSense.Host.Low | Number | The number of open findings of the host with low severity. |
| RiskSense.Host.Info | Number | The number of open findings of the host with info severity. |
| Ticket.ID | String | The ID of the ticket associated with the host. |
| Ticket.State | String | The state of the ticket associated with the host. |
Command Example
!risksense-get-host-detail host=united-78c957c5
Context Example
{
"Host": [
{
"Hostname": "united-78c957c5",
"ID": 3571259,
"IP": "53.132.37.52",
"OS": "Windows 2008/7"
}
],
"RiskSense.Host": [
{
"CMDB": [
{
"Key": "busines_criticality",
"Label": "Asset Criticality",
"Order": 1,
"Value": ""
},
{
"Key": "os",
"Label": "Operating System",
"Order": 2,
"Value": ""
},
{
"Key": "manufacturer",
"Label": "Manufactured By",
"Order": 3,
"Value": ""
},
{
"Key": "model_id",
"Label": "Model",
"Order": 4,
"Value": ""
},
{
"Key": "location",
"Label": "Location",
"Order": 5,
"Value": ""
},
{
"Key": "managed_by",
"Label": "Managed By",
"Order": 6,
"Value": ""
},
{
"Key": "owned_by",
"Label": "Owned By",
"Order": 7,
"Value": ""
},
{
"Key": "supported_by",
"Label": "Supported By",
"Order": 8,
"Value": ""
},
{
"Key": "support_group",
"Label": "Support Group",
"Order": 9,
"Value": ""
},
{
"Key": "sys_updated_on",
"Label": "Last Scanned",
"Order": 10,
"Value": ""
},
{
"Key": "asset_tag",
"Label": "Asset tags",
"Order": 11,
"Value": ""
},
{
"Key": "mac_address",
"Label": "Mac Address",
"Order": 12,
"Value": ""
},
{
"Key": "sys_id",
"Label": "Unique Id",
"Order": 16,
"Value": ""
},
{
"Key": "cf_1",
"Label": "Mike Name 1",
"Order": 18,
"Value": ""
},
{
"Key": "cf_2",
"Label": "Custom Field 2",
"Order": 19,
"Value": ""
},
{
"Key": "cf_3",
"Label": "Custom Field 3",
"Order": 20,
"Value": ""
},
{
"Key": "cf_4",
"Label": "Custom Field 4",
"Order": 21,
"Value": ""
},
{
"Key": "cf_5",
"Label": "Custom Field 5",
"Order": 22,
"Value": ""
},
{
"Key": "cf_6",
"Label": "Custom Field 6",
"Order": 23,
"Value": ""
},
{
"Key": "cf_7",
"Label": "Custom Field 7",
"Order": 24,
"Value": ""
},
{
"Key": "cf_8",
"Label": "Custom Field 8",
"Order": 25,
"Value": ""
},
{
"Key": "cf_9",
"Label": "Custom Field 9",
"Order": 26,
"Value": ""
},
{
"Key": "cf_10",
"Label": "Custom Field 10",
"Order": 29,
"Value": ""
},
{
"Key": "Asset Compliance",
"Label": "Asset Compliance",
"Order": 13,
"Value": ""
}
],
"ClientID": 747,
"Critical": 2,
"Criticality": 3,
"DiscoveredByRS": false,
"DiscoveredOn": "2007-01-23",
"Group": [
{
"ID": 7990,
"Name": "Default Group"
},
{
"ID": 8002,
"Name": "BU2_Other_Devices"
}
],
"GroupID": 7990,
"GroupName": "Default Group",
"High": 0,
"HostName": "united-78c957c5",
"Href": "http://platform.risksense.com/api/v1/client/747/host/search?page=0&size=20&sort=id,asc",
"ID": 3571259,
"Info": 0,
"IpAddress": "53.132.37.52",
"LastFoundOn": "2019-11-01",
"LastScanTime": "2007-01-23T16:46:50",
"LastThreatTrendingOn": null,
"LastVulnTrendingOn": null,
"Low": 0,
"Medium": 0,
"NetworkID": 78038,
"NetworkName": "IP Network",
"NetworkType": "IP",
"Note": [
{
"Date": "2019-12-30T11:35:41",
"Note": "Testing note\n",
"UserID": 5969,
"UserName": "Ravindra Sojitra"
},
{
"Date": "2019-12-30T11:38:25",
"Note": "This is second note for testing",
"UserID": 5969,
"UserName": "Ravindra Sojitra"
}
],
"OS": {
"Class": "Not Reported",
"Family": "Windows",
"Name": "Windows 2008/7",
"Vendor": "Microsoft"
},
"OldestOpenFindingWithThreatDiscoveredOn": "2014-09-24",
"PortNumbers": "135, 1025, 1494, 80, 139, 3389, 5353, 445",
"Rs3": 409,
"Services": "msrpc-epmap, blackjack, microsoft-ds, ica, ms-wbt-server, www, netbios-ssn, VxWorks",
"Source": [
{
"Name": "QUALYS",
"ScannerType": null,
"UuID": "QUALYS_SCANNER"
}
],
"Tag": [
{
"Category": "LOCATION",
"Color": "#dd8361",
"Created": "2019-04-24T21:37:06",
"Description": "",
"ID": 215552,
"Name": "Data_Center_2",
"Updated": "2019-04-24T21:37:06"
},
{
"Category": "PEOPLE",
"Color": "#78a19b",
"Created": "2019-04-24T21:42:34",
"Description": "",
"ID": 215557,
"Name": "Windows_Server_Team_1",
"Updated": "2019-04-24T21:42:34"
},
{
"Category": "CUSTOM",
"Color": "#648d9f",
"Created": "2019-10-29T20:22:25",
"Description": "",
"ID": 229865,
"Name": "Dev_Servers",
"Updated": "2019-10-29T20:22:25"
},
{
"Category": "SCANNER",
"Color": "#648d9f",
"Created": "2019-12-30T11:27:57",
"Description": "",
"ID": 232940,
"Name": "Test Ticket for host",
"Updated": "2019-12-30T11:28:00"
}
],
"Ticket": [
{
"ConnectorName": "Test JIRA ",
"DeepLink": "https://risksense.atlassian.net/browse/JINT-525",
"DetailedStatus": "",
"TicketNumber": "JINT-525",
"TicketStatus": "To Do",
"Type": "JIRA"
}
],
"Total": 2,
"Xrs3": null,
"Xrs3date": null
}
],
"Ticket": [
{
"ID": "JINT-525",
"State": "To Do"
}
]
}
Human Readable Output
Client: The Demo Client
Group Details
Name: Default Group
Most Recently Identified Service(s)
msrpc-epmap, blackjack, microsoft-ds, ica, ms-wbt-server, www, netbios-ssn, VxWorks
Sources
Scanner(s): QUALYS
Host Details
| Name | IP | RS3 | Discovered On | Last Found On |
|---|---|---|---|---|
| united-78c957c5 | 53.132.37.52 | 351 | 2007-01-23 | 2007-01-23 |
Findings Distribution
| Total | Critical | High | Medium | Low | Info |
|---|---|---|---|---|---|
| 2 | 2 | 0 | 0 | 0 | 0 |
Operating System
| Name | Vendor | Class | Family |
|---|---|---|---|
| Windows 2008/7 | Microsoft | Not Reported | Windows |
Tag(s) (4)
| Name | Category | Description | Created | Updated |
|---|---|---|---|---|
| Data_Center_2 | LOCATION | 2019-04-24T21:37:06 | 2019-04-24T21:37:06 | |
| Windows_Server_Team_1 | PEOPLE | 2019-04-24T21:42:34 | 2019-04-24T21:42:34 | |
| Dev_Servers | CUSTOM | 2019-10-29T20:22:25 | 2019-10-29T20:22:25 | |
| Test Ticket for host | SCANNER | 2019-12-30T11:27:57 | 2019-12-30T11:28:00 |
Ticket(s) (1)
| Ticket Number | Ticket Status | Deep Link | Type | Connector Name |
|---|---|---|---|---|
| JINT-525 | To Do | https://risksense.atlassian.net/browse/JINT-525 | JIRA | Test JIRA |
3. risksense-get-unique-cves
Looks up vulnerability details for the supplied host finding with its base score.
Base Command
risksense-get-unique-cves
Input
| Argument Name | Description | Required |
|---|---|---|
| hostFindingId | The unique host finding ID. The host finding ID is either known by RiskSense users or it can be found in the human-readable output or context data(RiskSense.HostFinding.ID) after executing ‘risksense-get-host-findings’ command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| RiskSense.UniqueVulnerabilities.Cve | String | Common Vulnerabilities and Exposures name. |
| RiskSense.UniqueVulnerabilities.HostFindingID | String | The unique ID of the host finding. |
| RiskSense.UniqueVulnerabilities.BaseScore | Unknown | The base score represents the severity of the risk (informational, low, medium, high, or critical). |
| RiskSense.UniqueVulnerabilities.ThreatCount | Number | Total number of threats found. |
| RiskSense.UniqueVulnerabilities.AttackVector | String | The attack vectors are a path by which attackers can gain access to the network. |
| RiskSense.UniqueVulnerabilities.AccessComplexity | String | The access complexity describes conditions that are beyond the attacker’s control that must exist in order to exploit the vulnerability. |
| RiskSense.UniqueVulnerabilities.Authentication | String | The authentication value represents attackers authorization to get network access. |
| RiskSense.UniqueVulnerabilities.ConfidentialityImpact | String | The confidentiality impact measures the potential impact on confidentiality of a successfully exploited misuse vulnerability. |
| RiskSense.UniqueVulnerabilities.Integrity | String | The Integrity refers to the trust level and veracity of the information. |
| RiskSense.UniqueVulnerabilities.AvailabilityImpact | String | The availability refers to accessibility of network resources. |
| RiskSense.UniqueVulnerabilities.Trending | Boolean | Trending is defined by RiskSense as vulnerabilities that are being actively abused by attackers in the wild based on activity in hacker forums, Twitter feeds, and analysis of 3rd party threat intelligence sources. |
| RiskSense.UniqueVulnerabilities.VulnLastTrendingOn | String | The last trending date of vulnerability. |
| CVE.ID | String | Common Vulnerabilities and Exposures ID. |
| CVE.Description | String | Description about CVE. |
| CVE.CVSS | String | The CVSS represents the severity of the risk (informational, low, medium, high, critical). |
Command Example
!risksense-get-unique-cves hostFindingId=115469504
Context Example
{
'RiskSense.UniqueVulnerabilities': [
{
'HostFindingID': '115469504',
'Cve': 'CVE-2007-0882',
'BaseScore': 10.0,
'ThreatCount': 5,
'AttackVector': 'Network',
'AccessComplexity': 'Low',
'Authentication': 'None',
'ConfidentialityImpact': 'Complete',
'Integrity': 'Complete',
'AvailabilityImpact': 'Complete',
'Trending': False,
'VulnLastTrendingOn': None
}
],
'CVE': [
{
'ID': 'CVE-2007-0882',
'CVSS': 10.0,
'Description': 'Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.'
}
]
}
Human Readable Output
Client: The Demo Client
Vulnerabilities found
| Name | V2/Score | Attack Vector | Attack Complexity | Authentication | Confidentiality Impact | Integrity Impact | Availability Impact | Summary |
|---|---|---|---|---|---|---|---|---|
| CVE-2007-0882 | 10.0 | Network | Low | None | Complete | Complete | Complete | Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client “-f” sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account. |
4. risksense-get-unique-open-findings
Finds unique open host findings.The open findings can be searched based on input parameters like fieldname (Severity, Title, Source etc), operator (EXACT, IN, LIKE, BETWEEN), page and size.
Base Command
risksense-get-unique-open-findings
Input
| Argument Name | Description | Required |
|---|---|---|
| fieldname | The RiskSense host finding attribute that should be considered for filtering the results. The available choices are ‘Title’, ‘Severity’, and ‘Source’. Apart from the available choices, one can provide the attributes supported by RiskSense API. Refer to the API /uniqueHostFinding/filter API to get the list of supported attributes. The uid of filter attributes must be provided here. e.g. assessment_labels, asset_tags, cvss3BaseI, etc. If specified, ‘value’ argument is mandatory. | Optional |
| operator | The match operator should be applied for filtering the hosts based on ‘fieldname’ and ‘value’. Available options are ‘EXACT’ - filter records exactly matching the criteria; ‘IN’ - filter records matching any one of the comma-separated values; ‘LIKE’ - filter records with the value matching the specified pattern. All the records fieldname value contains the string provided in value; ‘BETWEEN’ - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. | Optional |
| value | The value of the unique open finding property mentioned in ‘fieldname’ to be considered for filter criteria. | Optional |
| exclude | The exclude flag that determines whether the returned records matches filter criteria or not. By default set to False. | Optional |
| page | The index of the page. The index is a numeric value and starting with 0. | Optional |
| size | The maximum number of records to fetch in one page. | Optional |
| sort_by | The fieldname that should be considered for sorting the returned records. | Optional |
| sort_direction | The sorting direction to apply to returned records. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| RiskSense.UniqueHostFinding.Title | String | The title of the unique host finding. |
| RiskSense.UniqueHostFinding.Severity | Number | Similar to risk rating, the severity of a vulnerability conveys the potential threat. |
| RiskSense.UniqueHostFinding.HostCount | Number | The total number of hosts found in unique host finding. |
| RiskSense.UniqueHostFinding.Source | String | The name of the source associated with the unique host finding. |
| RiskSense.UniqueHostFinding.SourceID | String | The unique ID of the source. |
| RiskSense.UniqueHostFinding.Href | String | Reference API link of the unique host finding search. |
Command Example
!risksense-get-unique-open-findings fieldname=Source value=QUALYS sort_by=Severity sort_direction="Descending" size="3"
Context Example
{
"RiskSense.UniqueHostFinding": [
{
"Severity": 10,
"Title": "Solaris 10 and Solaris 11 (SolarisExpress) Remote Access Telnet Daemon Flaw",
"SourceID": "QUALYS38574",
"HostCount": 22,
"Source": "QUALYS",
"Href": "http://platform.risksense.com/api/v1/client/747/uniqueHostFinding/search?page=0&size=3&sort=severity,desc"
},
{
"Severity": 10,
"Title": "FreeBSD Telnetd Code Execution Vulnerability (FreeBSD-SA-11:08)",
"SourceID": "QUALYS119834",
"HostCount": 17,
"Source": "QUALYS",
"Href": "http://platform.risksense.com/api/v1/client/747/uniqueHostFinding/search?page=0&size=3&sort=severity,desc"
},
{
"Severity": 10,
"Title": "Microsoft SMB Server Remote Code Execution Vulnerability (MS17-010) and Shadow Brokers",
"SourceID": "QUALYS91345",
"HostCount": 140,
"Source": "QUALYS",
"Href": "http://platform.risksense.com/api/v1/client/747/uniqueHostFinding/search?page=0&size=3&sort=severity,desc"
}
]
}
Human Readable Output
Total unique open findings: 3949 Page: 0/1316 Client: The Demo Client
Unique open finding(s) details
| Title | Severity | Asset Count | Source | Source ID |
|---|---|---|---|---|
| Solaris 10 and Solaris 11 (SolarisExpress) Remote Access Telnet Daemon Flaw | 10.0 | 22 | QUALYS | QUALYS38574 |
| FreeBSD Telnetd Code Execution Vulnerability (FreeBSD-SA-11:08) | 10.0 | 17 | QUALYS | QUALYS119834 |
| Microsoft SMB Server Remote Code Execution Vulnerability (MS17-010) and Shadow Brokers | 10.0 | 140 | QUALYS | QUALYS91345 |
5. risksense-get-host-findings
A detailed host finding view with the severity level. Displays vulnerability information like CVE, Threats associated with current findings and origin of findings.
Base Command
risksense-get-host-findings
Input
| Argument Name | Description | Required |
|---|---|---|
| fieldname | The RiskSense host finding attribute that should be considered for filtering the results. The available choices are ‘Title’, ‘IP Address’, or ‘Host Name’. In addition to the available choices, you can provide the attributes supported by RiskSense API. Refer to the API /hostFinding/filter API to get the list of supported attributes. The uid of filter attributes must be provided here. e.g. assessment_labels, asset_tags, cvss3BaseI, etc. If specified, ‘value’ argument is mandatory. | Optional |
| operator | The match operator should be applied for filtering the hosts based on ‘fieldname’ and ‘value’. Available options are ‘EXACT’ (filter records exactly matching the criteria), ‘IN’ (filter records matching any one of the comma-separated values), or ‘LIKE’ (filter records with the value matching the specified pattern). All the records fieldname value contains the string provided in value; ‘BETWEEN’ - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. | Optional |
| exclude | The exclude flag that determines whether the returned records matches filter criteria or not. By default set to False. | Optional |
| value | The value of the ‘fieldname’ to be considered for filter criteria. | Optional |
| page | The index of the page. The index is numeric value starting with 0. | Optional |
| size | The maximum number of records to fetch in one page. | Optional |
| sort_by | The fieldname that should be considered for sorting the returned records. | Optional |
| sort_direction | The sorting direction to apply to returned records. | Optional |
| status | The status of the host findings to be considered for returned records. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| RiskSense.HostFinding.ID | String | The unique ID of the host finding. |
| RiskSense.HostFinding.Source | String | Host discovered by the scanner. |
| RiskSense.HostFinding.SourceID | String | Scanner ID of discovered scanner. |
| RiskSense.HostFinding.Title | String | The title of the host finding. |
| RiskSense.HostFinding.Port | Number | The port number of the host finding. |
| RiskSense.HostFinding.GroupCount | Number | The total number of groups for host finding. |
| RiskSense.HostFinding.Group.ID | Number | The unique ID of the group associated with the host finding. |
| RiskSense.HostFinding.Group.Name | String | The name of the group associated with the host finding. |
| RiskSense.HostFinding.HostID | Number | The unique ID of the host associated with the host finding. |
| RiskSense.HostFinding.HostName | String | The hostname of the host associated with the host finding. |
| RiskSense.HostFinding.HostIpAddress | String | The IP address of the host associated with the host finding. |
| RiskSense.HostFinding.Host.Criticality | Number | The criticality of the host associated with the host finding. |
| RiskSense.HostFinding.Host.External | boolean | Whether the identify of the host is external or internal. |
| RiskSense.HostFinding.Host.Port.ID | Number | The unique ID of the host(s) port associated with the host finding. |
| RiskSense.HostFinding.Host.Port.Number | Number | The port number of the host associated with the host finding. |
| RiskSense.HostFinding.Host.Rs3 | Number | The Asset Security Score calculated by the RiskSense platform (includes vulnerability risk on related web applications). |
| RiskSense.HostFinding.Network.ID | Number | The network ID of the host finding. |
| RiskSense.HostFinding.Network.Name | String | The name of the network used by the host finding. |
| RiskSense.HostFinding.Network.Type | String | The type of the network used by the host finding. |
| RiskSense.HostFinding.Assessment.ID | Number | The assessment ID of the host finding. |
| RiskSense.HostFinding.Assessment.Name | String | The name of the assessment associated with the host finding. |
| RiskSense.HostFinding.Assessment.Date | String | The time when the assessment is created. |
| RiskSense.HostFinding.Vulnerability.Cve | String | The name of the Common Vulnerabilities and Exposures associated with the host finding. |
| RiskSense.HostFinding.Vulnerability.BaseScore | Number | CVE Score. |
| RiskSense.HostFinding.Vulnerability.ThreatCount | Number | The total number of threats associated with the host finding. |
| RiskSense.HostFinding.Vulnerability.AttackVector | String | Vector information in which the host was attacked. |
| RiskSense.HostFinding.Vulnerability.AccessComplexity | String | Complexity level. |
| RiskSense.HostFinding.Vulnerability.Authentication | String | Authentication value represents attackers authorization to get network access. |
| RiskSense.HostFinding.Vulnerability.ConfidentialityImpact | String | Confidentiality impact measures the potential impact on confidentiality of a successfully exploited misuse vulnerability. |
| RiskSense.HostFinding.Vulnerability.Integrity | String | Integrity refers to the trustworthiness and veracity of information. |
| RiskSense.HostFinding.Vulnerability.AvailabilityImpact | String | Availability refers to accessibility of network resources. |
| RiskSense.HostFinding.Vulnerability.Trending | boolean | This signifies whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending. |
| RiskSense.HostFinding.Vulnerability.VulnLastTrendingOn | String | Date when last trending vulnerability was found. |
| RiskSense.HostFinding.ThreatCount | Number | The total number of threats. |
| RiskSense.HostFinding.Threat.Title | String | The title of the threat. |
| RiskSense.HostFinding.Threat.Category | String | The threat category. |
| RiskSense.HostFinding.Threat.Severity | String | The severity level of the threat. |
| RiskSense.HostFinding.Threat.Description | String | The threat description. |
| RiskSense.HostFinding.Threat.Cve | Unknown | The Common Vulnerabilities and Exposures name of the threat. |
| RiskSense.HostFinding.Threat.Source | String | The source of the threat. |
| RiskSense.HostFinding.Threat.Published | String | The time when the threat was published. |
| RiskSense.HostFinding.Threat.Updated | String | The time when the threat was last updated. |
| RiskSense.HostFinding.Threat.ThreatLastTrendingOn | String | The last time when threat was in trending. |
| RiskSense.HostFinding.Threat.Trending | boolean | Whether the threat is trending. |
| RiskSense.HostFinding.Patch.Name | String | The patch name of the host finding. |
| RiskSense.HostFinding.Patch.Url | String | The patch URL of the host finding. |
| RiskSense.HostFinding.TagCount | Number | The total number of tags associated with host finding. |
| RiskSense.HostFinding.Tag.ID | Number | The tag identifier of the host finding. |
| RiskSense.HostFinding.Tag.Name | String | The tag name of the host finding. |
| RiskSense.HostFinding.Tag.Category | String | The tag category of the host finding. |
| RiskSense.HostFinding.Tag.Description | String | The tag description of the host finding. |
| RiskSense.HostFinding.Tag.Created | String | The time when the tag was created. |
| RiskSense.HostFinding.Tag.Updated | String | The time when the tag was last updated. |
| RiskSense.HostFinding.Tag.Color | String | The color of the tag. |
| RiskSense.HostFinding.TagAssetCount | Number | The total number of tag assets. |
| RiskSense.HostFinding.TagAsset.ID | Number | The ID of the tag asset. |
| RiskSense.HostFinding.TagAsset.Name | String | The name of the tag asset. |
| RiskSense.HostFinding.TagAsset.Category | String | The category of the tag asset. |
| RiskSense.HostFinding.TagAsset.Description | String | The description of the tag asset. |
| RiskSense.HostFinding.TagAsset.Created | String | The date and time when tag asset was created. |
| RiskSense.HostFinding.TagAsset.Updated | String | The time when the tag asset was last updated. |
| RiskSense.HostFinding.TagAsset.Color | String | The color name of the tag asset. |
| RiskSense.HostFinding.Output | String | The output of the host finding. |
| RiskSense.HostFinding.Severity | Number | The severity of the host finding. |
| RiskSense.HostFinding.SeverityDetail.Combined | Number | The combined name of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.Overridden | boolean | The overridden name of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.Scanner | String | The scanner of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.CvssV2 | Number | The CVSS v2 value of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.CvssV3 | Number | The CVSS v3 value of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.Aggregated | Number | The aggregated value of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.State | String | The state of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.StateName | String | The state name of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.ExpirationDate | String | The time when the severity detail expired. |
| RiskSense.HostFinding.RiskRating | Number | The risk rate of the host finding. |
| RiskSense.HostFinding.Xrs3Impact | String | The impact of xrs3 for the host finding. |
| RiskSense.HostFinding.Xrs3ImpactOnCategory | String | The category impact of xrs3 for the host finding. |
| RiskSense.HostFinding.LastFoundOn | String | The latest time when the particular host finding is found. |
| RiskSense.HostFinding.DiscoveredOn | String | The time when the host finding was discovered. |
| RiskSense.HostFinding.ResolvedOn | String | The time when the host finding was resolved. |
| RiskSense.HostFinding.ScannerName | String | The name of the scanner of the host finding. |
| RiskSense.HostFinding.FindingType | String | The finding type of the host finding. |
| RiskSense.HostFinding.MachineID | String | The machine ID of the host finding. |
| RiskSense.HostFinding.StatusEmbedded.State | String | The current state of embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.StateName | String | The state name of embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.StateDescription | String | The state description of embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.Status | boolean | The status of embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.DurationInDays | String | The time duration (In days) of embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.DueDate | String | The due date of embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.ExpirationDate | String | The time when the status is expired associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReportCount | Number | The total number of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.ID | Number | The ID of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.Title | String | The title of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.Label | String | The label of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.Pii | String | The PII number of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.Source | String | The source of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.IsManualExploit | boolean | Whether the manual finding report is an exploit. |
| RiskSense.HostFinding.ManualFindingReport.EaseOfExploit | String | The total number of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.NoteCount | Number | Number of notes found for the host finding. |
| RiskSense.HostFinding.Note.Date | String | The time when the note was added by the user for the host finding. |
| RiskSense.HostFinding.Note.Note | String | The notes that were added by the user for the host finding. |
| RiskSense.HostFinding.Note.UserID | Number | The User ID of the user who added the note for the host finding. |
| RiskSense.HostFinding.Note.UserName | String | The username of the user who added a note for the host finding. |
| RiskSense.HostFinding.Assignment.ID | Number | The unique ID of the assignment associated with the host finding. |
| RiskSense.HostFinding.Assignment.FirstName | String | The first name of the assigned user for the host finding. |
| RiskSense.HostFinding.Assignment.LastName | String | The last name of the assigned user for the host finding. |
| RiskSense.HostFinding.Assignment.ReceiveEmails | boolean | Indicates whether the email was received. |
| RiskSense.HostFinding.Assignment.Email | String | The email address of the assigned user for the host finding. |
| RiskSense.HostFinding.Assignment.Username | String | The username of the assigned user for the host finding. |
| RiskSense.HostFinding.Services | String | The name of the services for the host finding. |
| Ticket.ID | String | The ID of the ticket associated with the host finding. |
| Ticket.State | String | The state of the ticket associated with the host finding. |
| Host.Hostname | String | The hostname of the host. |
| Host.ID | String | The unique ID within the tool retrieving the host. |
| Host.IP | String | The IP address of the host. |
| CVE.ID | String | Common Vulnerabilities and Exposures ID. |
| CVE.Description | String | Description of the CVE. |
| CVE.CVSS | String | The CVSS represents the severity of the risk (informational, low, medium, high, critical). |
| RiskSense.HostFinding.Ticket.TicketNumber | String | The number of tickets associated with the host finding. |
| RiskSense.HostFinding.Ticket.TicketStatus | String | The status of the ticket associated with the host finding. |
| RiskSense.HostFinding.Ticket.DeepLink | String | The deeplink associated with the ticket associated with the host finding. |
| RiskSense.HostFinding.Ticket.Type | String | The type of ticket associated with the host finding. |
| RiskSense.HostFinding.Ticket.ConnectorName | String | The connector name of the ticket associated with the host finding. |
| RiskSense.HostFinding.Ticket.DetailedStatus | String | The detailed status of the ticket associated with the host finding. |
| RiskSense.HostFinding.GroupID | Number | The unique ID of the group associated with the host finding. |
| RiskSense.HostFinding.GroupName | String | The name of the group associated with the host finding. |
Command Example
!risksense-get-host-findings fieldname="Host Name" value=loz.xg.mil sort_by="Risk Rating" sort_direction="Descending" size="2"
Context Example
{
"Host": [
{
"IP": "116.145.139.179",
"Hostname": "loz.xg.mil",
"ID": 3569982
},
{
"IP": "116.145.139.179",
"Hostname": "loz.xg.mil",
"ID": 3569982
}
],
"CVE": [
{
"ID": "CVE-2007-0882",
"CVSS": 10,
"Description": "Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client \"-f\" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account."
},
{
"ID": "CVE-2011-4862",
"CVSS": 10,
"Description": "Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011."
}
],
"RiskSense.HostFinding": [
{
"ResolvedOn": "2019-06-12",
"Group": [
{
"ID": 7990,
"Name": "Default Group"
}
],
"Network": {
"Type": "IP",
"ID": 78038,
"Name": "IP Network"
},
"StatusEmbedded": {
"Status": false,
"StateDescription": "Finding was approved in risk acceptance workflow",
"StateName": "RA Approved",
"State": "ACCEPTED",
"ExpirationDate": "",
"DurationInDays": "3246",
"DueDate": "2019-12-01T00:00:00"
},
"Title": "Solaris 10 and Solaris 11 (SolarisExpress) Remote Access Telnet Daemon Flaw",
"TagAsset": [
{
"Category": "Location",
"Updated": "2019-06-19T19:23:08",
"Name": "Data_Center_1",
"Created": "2019-04-24T21:35:12",
"Color": "#dd8361",
"ID": 215551
},
{
"Category": "People",
"Updated": "2019-04-24T21:39:59",
"Name": "Linux_Team_2",
"Created": "2019-04-24T21:39:59",
"Color": "#78a19b",
"ID": 215554
}
],
"GroupCount": 1,
"Note": [
{
"Date": "2019-04-24T23:00:57.973",
"Note": "These devices are to be decommissioned soon",
"UserID": 2425,
"UserName": "Ryan Riley"
}
],
"Source": "QUALYS",
"SeverityDetail": {
"CvssV3": null,
"CvssV2": 10,
"Scanner": "5",
"Overridden": false,
"StateName": null,
"State": null,
"ExpirationDate": "",
"Aggregated": 10,
"Combined": 10
},
"Assessment": [
{
"Date": "2019-04-23",
"ID": 67442,
"Name": "First Assessment"
}
],
"TagCount": 5,
"Severity": 10,
"RiskRating": 10,
"SourceID": "QUALYS38574",
"Assignment": [],
"HostName": "loz.xg.mil",
"Xrs3ImpactOnCategory": null,
"TagAssetCount": 2,
"Host": {
"Rs3": 644,
"External": true,
"Criticality": 5,
"Port": [
{
"ID": 42841210,
"Number": 21
},
{
"ID": 42841323,
"Number": 22
},
{
"ID": 42841347,
"Number": 23
},
{
"ID": 42841183,
"Number": 25
},
{
"ID": 42841178,
"Number": 111
},
{
"ID": 42841312,
"Number": 123
},
{
"ID": 42841336,
"Number": 587
},
{
"ID": 42841279,
"Number": 852
},
{
"ID": 42841222,
"Number": 6112
},
{
"ID": 42841168,
"Number": 7100
},
{
"ID": 42841236,
"Number": 8005
},
{
"ID": 42841197,
"Number": 8007
},
{
"ID": 42841329,
"Number": 32771
},
{
"ID": 42841246,
"Number": 32772
},
{
"ID": 42841259,
"Number": 32775
},
{
"ID": 42841269,
"Number": 32776
},
{
"ID": 42841361,
"Number": 32777
},
{
"ID": 42841370,
"Number": 32778
},
{
"ID": 42841172,
"Number": 32779
}
]
},
"Services": "",
"Ticket": [],
"ThreatCount": 5,
"Xrs3Impact": null,
"DiscoveredOn": "2010-07-22",
"HostID": 3569982,
"NoteCount": 1,
"Vulnerability": [
{
"Trending": false,
"AttackVector": "Network",
"VulnLastTrendingOn": null,
"BaseScore": 10,
"AvailabilityImpact": "Complete",
"Authentication": "None",
"AccessComplexity": "Low",
"ConfidentialityImpact": "Complete",
"Cve": "CVE-2007-0882",
"Integrity": "Complete",
"ThreatCount": 5
}
],
"Patch": [],
"Threat": [
{
"Category": "Exploit",
"ThreatLastTrendingOn": null,
"Updated": "2020-02-13T15:32:52",
"Trending": false,
"Severity": null,
"Title": "Sun Solaris Telnet Remote Authentication Bypass Vulnerability",
"Source": "METASPLOIT",
"Published": "2007-02-17T00:00:00",
"Cve": "CVE-2007-0882",
"Description": "This module exploits the argument injection vulnerability\n in the telnet daemon (in.telnetd) of Solaris 10 and 11."
},
{
"Category": "Exploit",
"ThreatLastTrendingOn": null,
"Updated": "2020-02-08T07:54:43",
"Trending": false,
"Severity": null,
"Title": "Sun Solaris Telnet - Remote Authentication Bypass (Metasploit)",
"Source": "EXPLOIT DB",
"Published": "2010-06-22T00:00:00",
"Cve": "CVE-2007-0882",
"Description": "Sun Solaris Telnet - Remote Authentication Bypass (Metasploit)"
},
{
"Category": "Exploit",
"ThreatLastTrendingOn": null,
"Updated": "2020-02-08T07:54:43",
"Trending": false,
"Severity": null,
"Title": "Solaris 10/11 Telnet - Remote Authentication Bypass (Metasploit)",
"Source": "EXPLOIT DB",
"Published": "2007-02-12T00:00:00",
"Cve": "CVE-2007-0882",
"Description": "Solaris 10/11 Telnet - Remote Authentication Bypass (Metasploit)"
},
{
"Category": "Exploit",
"ThreatLastTrendingOn": null,
"Updated": "2020-02-08T07:54:43",
"Trending": false,
"Severity": null,
"Title": "SunOS 5.10/5.11 in.TelnetD - Remote Authentication Bypass",
"Source": "EXPLOIT DB",
"Published": "2007-02-11T00:00:00",
"Cve": "CVE-2007-0882",
"Description": "SunOS 5.10/5.11 in.TelnetD - Remote Authentication Bypass"
},
{
"Category": "Worm",
"ThreatLastTrendingOn": null,
"Updated": "2019-08-16T15:50:12",
"Trending": false,
"Severity": null,
"Title": "Solaris.Wanuk.Worm",
"Source": "SYMANTEC",
"Published": "2007-02-28T00:00:00",
"Cve": "CVE-2007-0882",
"Description": ""
}
],
"Output": "Detected service telnet and os SOLARIS 9-11",
"ID": 115469505,
"ManualFindingReport": [],
"HostIpAddress": "116.145.139.179",
"ManualFindingReportCount": 0,
"FindingType": "Auth/Unauthenticated",
"Tag": [
{
"Category": "Location",
"Updated": "2019-06-19T19:23:08",
"Name": "Data_Center_1",
"Created": "2019-04-24T21:35:12",
"Color": "#dd8361",
"ID": 215551,
"Description": ""
},
{
"Category": "People",
"Updated": "2019-04-24T21:39:59",
"Name": "Linux_Team_2",
"Created": "2019-04-24T21:39:59",
"Color": "#78a19b",
"ID": 215554,
"Description": ""
},
{
"Category": "Project",
"Updated": "2019-10-31T03:40:55",
"Name": "PCI Assets",
"Created": "2019-08-28T18:50:30",
"Color": "#648d9f",
"ID": 225750,
"Description": ""
},
{
"Category": "Custom",
"Updated": "2019-11-19T23:40:40",
"Name": "CVSS_Sev_Crit_Test",
"Created": "2019-11-19T23:40:40",
"Color": "#648d9f",
"ID": 230966,
"Description": "CVSS Crits"
},
{
"Category": "Custom",
"Updated": "2019-11-19T23:41:36",
"Name": "RR_Crit_Test",
"Created": "2019-11-19T23:41:36",
"Color": "#648d9f",
"ID": 230967,
"Description": "Risk Rating Crit Test"
}
],
"LastFoundOn": "2010-07-22",
"MachineID": "",
"Port": null,
"ScannerName": "QUALYS"
},
{
"ResolvedOn": "2019-06-12",
"Group": [
{
"ID": 7990,
"Name": "Default Group"
}
],
"Network": {
"Type": "IP",
"ID": 78038,
"Name": "IP Network"
},
"StatusEmbedded": {
"Status": false,
"StateDescription": "Finding was approved in risk acceptance workflow",
"StateName": "RA Approved",
"State": "ACCEPTED",
"ExpirationDate": "",
"DurationInDays": "2690",
"DueDate": "2019-12-01T00:00:00"
},
"Title": "FreeBSD Telnetd Code Execution Vulnerability (FreeBSD-SA-11:08)",
"TagAsset": [
{
"Category": "Location",
"Updated": "2019-06-19T19:23:08",
"Name": "Data_Center_1",
"Created": "2019-04-24T21:35:12",
"Color": "#dd8361",
"ID": 215551
},
{
"Category": "People",
"Updated": "2019-04-24T21:39:59",
"Name": "Linux_Team_2",
"Created": "2019-04-24T21:39:59",
"Color": "#78a19b",
"ID": 215554
}
],
"GroupCount": 1,
"Note": [],
"Source": "QUALYS",
"SeverityDetail": {
"CvssV3": null,
"CvssV2": 10,
"Scanner": "4",
"Overridden": false,
"StateName": null,
"State": null,
"ExpirationDate": "",
"Aggregated": 10,
"Combined": 8
},
"Assessment": [
{
"Date": "2019-04-23",
"ID": 67442,
"Name": "First Assessment"
}
],
"TagCount": 5,
"Severity": 8,
"RiskRating": 10,
"SourceID": "QUALYS119834",
"Assignment": [],
"HostName": "loz.xg.mil",
"Xrs3ImpactOnCategory": null,
"TagAssetCount": 2,
"Host": {
"Rs3": 644,
"External": true,
"Criticality": 5,
"Port": [
{
"ID": 42841210,
"Number": 21
},
{
"ID": 42841323,
"Number": 22
},
{
"ID": 42841347,
"Number": 23
},
{
"ID": 42841183,
"Number": 25
},
{
"ID": 42841178,
"Number": 111
},
{
"ID": 42841312,
"Number": 123
},
{
"ID": 42841336,
"Number": 587
},
{
"ID": 42841279,
"Number": 852
},
{
"ID": 42841222,
"Number": 6112
},
{
"ID": 42841168,
"Number": 7100
},
{
"ID": 42841236,
"Number": 8005
},
{
"ID": 42841197,
"Number": 8007
},
{
"ID": 42841329,
"Number": 32771
},
{
"ID": 42841246,
"Number": 32772
},
{
"ID": 42841259,
"Number": 32775
},
{
"ID": 42841269,
"Number": 32776
},
{
"ID": 42841361,
"Number": 32777
},
{
"ID": 42841370,
"Number": 32778
},
{
"ID": 42841172,
"Number": 32779
}
]
},
"Services": "",
"Ticket": [],
"ThreatCount": 6,
"Xrs3Impact": null,
"DiscoveredOn": "2012-01-29",
"HostID": 3569982,
"NoteCount": 0,
"Vulnerability": [
{
"Trending": false,
"AttackVector": "Network",
"VulnLastTrendingOn": null,
"BaseScore": 10,
"AvailabilityImpact": "Complete",
"Authentication": "None",
"AccessComplexity": "Low",
"ConfidentialityImpact": "Complete",
"Cve": "CVE-2011-4862",
"Integrity": "Complete",
"ThreatCount": 6
}
],
"Patch": [],
"Threat": [
{
"Category": "Exploit",
"ThreatLastTrendingOn": null,
"Updated": "2020-02-08T07:49:42",
"Trending": false,
"Severity": null,
"Title": "TelnetD encrypt_keyid - Function Pointer Overwrite",
"Source": "EXPLOIT DB",
"Published": "2011-12-26T00:00:00",
"Cve": "CVE-2011-4862",
"Description": "TelnetD encrypt_keyid - Function Pointer Overwrite"
},
{
"Category": "Exploit",
"ThreatLastTrendingOn": null,
"Updated": "2020-02-08T07:49:44",
"Trending": false,
"Severity": null,
"Title": "Linux BSD-derived Telnet Service Encryption Key ID - Remote Buffer Overflow (Metasploit)",
"Source": "EXPLOIT DB",
"Published": "2012-01-14T00:00:00",
"Cve": "CVE-2011-4862",
"Description": "Linux BSD-derived Telnet Service Encryption Key ID - Remote Buffer Overflow (Metasploit)"
},
{
"Category": "Exploit",
"ThreatLastTrendingOn": null,
"Updated": "2020-02-29T16:00:18",
"Trending": false,
"Severity": null,
"Title": "Telnet Service Encryption Key ID Overflow Detection",
"Source": "METASPLOIT",
"Published": "2011-12-27T00:00:00",
"Cve": "CVE-2011-4862",
"Description": "Detect telnet services vulnerable to the encrypt option Key ID overflow (BSD-derived telnetd)"
},
{
"Category": "Exploit",
"ThreatLastTrendingOn": null,
"Updated": "2020-02-13T15:32:41",
"Trending": false,
"Severity": null,
"Title": "Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow",
"Source": "METASPLOIT",
"Published": "2011-12-27T00:00:00",
"Cve": "CVE-2011-4862",
"Description": "This module exploits a buffer overflow in the encryption option handler of the\n Linux BSD-derived telnet service (inetutils or krb5-telnet). Most Linux distributions\n use NetKit-derived telnet daemons, so this flaw only applies to a small subset of\n Linux systems running telnetd."
},
{
"Category": "Exploit",
"ThreatLastTrendingOn": null,
"Updated": "2020-02-13T15:32:40",
"Trending": false,
"Severity": null,
"Title": "FreeBSD Telnet Service Encryption Key ID Buffer Overflow",
"Source": "METASPLOIT",
"Published": "2011-12-27T00:00:00",
"Cve": "CVE-2011-4862",
"Description": "This module exploits a buffer overflow in the encryption option handler of the\n FreeBSD telnet service."
},
{
"Category": "Exploit",
"ThreatLastTrendingOn": null,
"Updated": "2020-02-08T07:49:41",
"Trending": false,
"Severity": null,
"Title": "FreeBSD - Telnet Service Encryption Key ID Buffer Overflow (Metasploit)",
"Source": "EXPLOIT DB",
"Published": "2012-01-14T00:00:00",
"Cve": "CVE-2011-4862",
"Description": "FreeBSD - Telnet Service Encryption Key ID Buffer Overflow (Metasploit)"
}
],
"Output": "Remote encryption-supported telnet server is potentially affected by "FreeBSD Telnetd Code Execution Vulnerability"",
"ID": 115469517,
"ManualFindingReport": [],
"HostIpAddress": "116.145.139.179",
"ManualFindingReportCount": 0,
"FindingType": "Auth/Unauthenticated",
"Tag": [
{
"Category": "Location",
"Updated": "2019-06-19T19:23:08",
"Name": "Data_Center_1",
"Created": "2019-04-24T21:35:12",
"Color": "#dd8361",
"ID": 215551,
"Description": ""
},
{
"Category": "People",
"Updated": "2019-04-24T21:39:59",
"Name": "Linux_Team_2",
"Created": "2019-04-24T21:39:59",
"Color": "#78a19b",
"ID": 215554,
"Description": ""
},
{
"Category": "Project",
"Updated": "2019-10-31T03:40:55",
"Name": "PCI Assets",
"Created": "2019-08-28T18:50:30",
"Color": "#648d9f",
"ID": 225750,
"Description": ""
},
{
"Category": "Custom",
"Updated": "2019-11-19T23:40:40",
"Name": "CVSS_Sev_Crit_Test",
"Created": "2019-11-19T23:40:40",
"Color": "#648d9f",
"ID": 230966,
"Description": "CVSS Crits"
},
{
"Category": "Custom",
"Updated": "2019-11-19T23:41:36",
"Name": "RR_Crit_Test",
"Created": "2019-11-19T23:41:36",
"Color": "#648d9f",
"ID": 230967,
"Description": "Risk Rating Crit Test"
}
],
"LastFoundOn": "2012-01-29",
"MachineID": "",
"Port": null,
"ScannerName": "QUALYS"
}
]
}
Human Readable Output
Total host findings: 16 Page: 0/7 Client: The Demo Client
Host finding(s) details
| ID | Host Name | IP Address | Title | Risk | Threats | RS3 | Criticality | Severity | Groups | State | Tags | Asset Tags | Note | Manual Finding Report Count |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 115469505 | loz.xg.mil | 116.145.139.179 | Solaris 10 and Solaris 11 (SolarisExpress) Remote Access Telnet Daemon Flaw | 10.0 | 5 | 644 | 5 | 10.0 | 1 | ACCEPTED | 5 | 2 | 1 | 0 |
| 115469517 | loz.xg.mil | 116.145.139.179 | FreeBSD Telnetd Code Execution Vulnerability (FreeBSD-SA-11:08) | 10.0 | 6 | 644 | 5 | 8.0 | 1 | ACCEPTED | 5 | 2 | 0 | 0 |
6. risksense-get-apps
Looks up the application details. The application details can be searched based on input parameters like fieldname (Name, Network, Address), operator (EXACT, IN, LIKE, BETWEEN), page, size, sort by and sort direction.
Base Command
risksense-get-apps
Input
| Argument Name | Description | Required |
|---|---|---|
| fieldname | The RiskSense application attribute that should be considered for filtering the results. The available choices are ‘Name’, ‘Network’, or ‘Address’. Apart from the available choices, one can provide the attributes supported by RiskSense API. Refer to the API /application/filter API to get the list of supported attributes. The uid of filter attributes must be provided here. e.g. assessment_labels, asset_tags, cvss3BaseI, etc. If specified, ‘value’ argument is mandatory. | Optional |
| operator | The match operator should be applied for filtering the hosts based on ‘fieldname’ and ‘value’. Available options are ‘EXACT’ (filter records exactly matching the criteria), ‘IN’ (filter records matching any one of the comma-separated values), or ‘LIKE’ (filter records with the value matching the specified pattern). All the records fieldname value contains the string provided in value; ‘BETWEEN’ - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. | Optional |
| value | The value of the apps property mentioned in ‘fieldname’ to be considered for filter criteria. | Optional |
| exclude | The exclude flag that determines whether the returned records matches filter criteria or not. The default is “false”. | Optional |
| page | The index of the page. The index is a numeric value and starting with 0. | Optional |
| size | The maximum number of records to fetch in one page. | Optional |
| sort_by | The fieldname that should be considered for sorting the returned records. | Optional |
| sort_direction | The sorting direction to apply to returned records. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| RiskSense.Application.ID | Number | The unique ID within the tool retrieving the application. |
| RiskSense.Application.GroupID | Number | The group ID of the application. |
| RiskSense.Application.GroupName | String | The group name of the application. |
| RiskSense.Application.Group.ID | Number | The ID of the group belonging to the Application. |
| RiskSense.Application.Group.Name | String | The name of the group belonging to the Application. |
| RiskSense.Application.Network.ID | Number | The network ID of the application. |
| RiskSense.Application.Network.Name | String | The network name of the application. |
| RiskSense.Application.Network.Type | String | The network type of the application. |
| RiskSense.Application.ClientID | Number | The client ID of the application. |
| RiskSense.Application.HostID | Number | The host ID of the application. |
| RiskSense.Application.Uri | String | The reference URI of the application. |
| RiskSense.Application.Name | String | The name of the application. |
| RiskSense.Application.Description | String | The detailed description of the application. |
| RiskSense.Application.NoteCount | Number | The total number of notes found in the application. |
| RiskSense.Application.DiscoveredOn | String | The time when the application was discovered. |
| RiskSense.Application.LastFoundOn | String | The time when the application was last found. |
| RiskSense.Application.Total | Number | The total number of open findings of the application. |
| RiskSense.Application.Critical | Number | The number of open findings of the application with critical severity. |
| RiskSense.Application.High | Number | The number of open findings of the application with high severity. |
| RiskSense.Application.Medium | Number | The number of open findings of the application with medium severity. |
| RiskSense.Application.Low | Number | The number of open findings of the application with low severity. |
| RiskSense.Application.Info | Number | The number of open findings of the application with info severity. |
| RiskSense.Application.Icon.Type | String | The type of icon of the application. |
| RiskSense.Application.Icon.OverlayText | String | The overlay text of the icon of the application. |
| RiskSense.Application.TagCount | Number | The total number of tags of the application. |
| RiskSense.Application.UrlCount | Number | The total number of URLs of the application. |
| RiskSense.Application.Href | String | The deeplink pointing to the application details on RiskSense. |
| RiskSense.Application.CMDB.ManufacturedBy | String | The name of the manufacturer in the configuration management DB (CMDB) from application details. |
| RiskSense.Application.CMDB.Model | String | The CMDB model name of the application. |
| RiskSense.Application.CMDB.MacAddress | String | The CMDB MAC address of the application. |
| RiskSense.Application.CMDB.Location | String | The CMDB location of the application. |
| RiskSense.Application.CMDB.ManagedBy | String | The CMDB entity name that managed the application. |
| RiskSense.Application.CMDB.OwnedBy | String | The CMDB entity name that owned the application. |
| RiskSense.Application.CMDB.SupportedBy | String | The CMDB entity name that supported the application |
| RiskSense.Application.CMDB.SupportGroup | String | The CMDB supporting group of the application. |
| RiskSense.Application.CMDB.SysID | String | The CMDB system ID of the application. |
| RiskSense.Application.CMDB.OperatingSystem | String | The CMDB operating system of the application. |
| RiskSense.Application.CMDB.LastScanDate | String | The CMDB last scan date of the application. |
| RiskSense.Application.CMDB.FerpaComplianceAsset | Boolean | The Family Educational Rights and Privacy Act. |
| RiskSense.Application.CMDB.HipaaComplianceAsset | Boolean | Health Insurance Portability and Accountability Act. |
| RiskSense.Application.CMDB.PciComplianceAsset | String | The Payment Card Industry (PCI) Council continues to make changes to ensure that their standards are up to date with emerging threats and changes in the market. |
| RiskSense.Application.Ticket.TicketNumber | String | The number of the ticket associated with the application. |
| RiskSense.Application.Ticket.TicketStatus | String | The status of the ticket associated with the application. |
| RiskSense.Application.Ticket.Type | String | The type of ticket associated with the application. |
| RiskSense.Application.Ticket.ConnectorName | String | The connector name of the ticket associated with the application. |
| RiskSense.Application.Ticket.DetailedStatus | String | The detailed status of ticket associated with the application. |
| RiskSense.Application.Ticket.DeepLink | String | The deeplink associated with the ticket associated with the application. |
| RiskSense.Application.Source.Name | String | The name of the source associated with the application. |
| RiskSense.Application.Source.UuID | String | The unique ID of the source associated with the application. |
| RiskSense.Application.Source.ScannerType | String | The type of scanner of the source associated with the application.. |
| RiskSense.Application.Note.UserID | String | The user ID of the user who added a note for the application. |
| RiskSense.Application.Note.UserName | String | The username of the user who added a note for the application. |
| RiskSense.Application.Note.Note | String | The notes that were added by the user for the application. |
| RiskSense.Application.Note.Date | String | The time when the note was added by the user for the application. |
| RiskSense.Application.Tag.ID | Number | The ID of the tag. |
| RiskSense.Application.Tag.Name | String | The name of the tag. |
| RiskSense.Application.Tag.Category | String | The category of the tag. |
| RiskSense.Application.Tag.Description | String | The description of the tag. |
| RiskSense.Application.Tag.Created | String | The time when the tag was created. |
| RiskSense.Application.Tag.Updated | String | The time when the tag was last updated. |
| RiskSense.Application.Tag.Color | String | The color code of the tag of the application. |
| Ticket.ID | String | The ID of the ticket associated with the application. |
| Ticket.State | String | The state of the ticket associated with the application. |
Command Example
!risksense-get-apps fieldname=Network value=App-data sort_by="Total Findings" sort_direction="Descending" size="3"
Context Example
{
"RiskSense.Application": [
{
"Network": {
"Type": "IP",
"ID": 91502,
"Name": "App-data"
},
"Note": [
{
"Date": "2020-01-28T12:21:06",
"Note": "Hiiii",
"UserID": 5969,
"UserName": "Ravindra Sojitra"
}
],
"Source": [
{
"ScannerType": "SAST",
"Name": "VERACODESAST",
"UuID": "VERACODESAST"
}
],
"Critical": 2,
"Low": 21,
"TagCount": 0,
"Medium": 281,
"Description": null,
"ClientID": 747,
"GroupID": 7990,
"Tag": [],
"Groups": [
{
"ID": 7990,
"Name": "Default Group"
}
],
"Ticket": [],
"Icon": [
{
"Type": "VERACODESAST",
"OverlayText": null
},
{
"Type": "OWASP",
"OverlayText": "A1"
},
{
"Type": "OWASP",
"OverlayText": "A3"
},
{
"Type": "OWASP",
"OverlayText": "A2"
},
{
"Type": "WASC",
"OverlayText": "SQL Injection"
},
{
"Type": "WASC",
"OverlayText": "HTTP Response Splitting"
},
{
"Type": "WASC",
"OverlayText": "OS Commanding"
},
{
"Type": "WASC",
"OverlayText": "URl Redirector Abuse"
},
{
"Type": "WASC",
"OverlayText": "HTTP Request Splitting"
},
{
"Type": "WASC",
"OverlayText": "Brute Force"
},
{
"Type": "WASC",
"OverlayText": "Session Fixation"
}
],
"Info": 1,
"DiscoveredOn": "2019-06-11",
"HostID": null,
"Name": "RS TestApp 1",
"NoteCount": 1,
"Uri": "RS TestApp 1",
"GroupName": "Default Group",
"ID": 19391,
"CMDB": {
"MacAddress": null,
"SupportGroup": null,
"SysID": null,
"HipaaComplianceAsset": false,
"OperatingSystem": null,
"ManufacturedBy": null,
"ManagedBy": null,
"Location": null,
"OwnedBy": null,
"Model": null,
"LastScanDate": "2019-06-11",
"FerpaComplianceAsset": false,
"SupportedBy": null,
"PciComplianceAsset": false
},
"UrlCount": 74,
"High": 20,
"Href": "http://platform.risksense.com/api/v1/client/747/application/search?page=0&size=3&sort=findingsDistribution.total,desc",
"LastFoundOn": "2019-06-11",
"Total": 325
},
{
"Network": {
"Type": "IP",
"ID": 91502,
"Name": "App-data"
},
"Note": [],
"Source": [
{
"ScannerType": "DAST",
"Name": "HPWEBINSPECT",
"UuID": "HPWEBINSPECT"
}
],
"Critical": 19,
"Low": 157,
"TagCount": 0,
"Medium": 8,
"Description": null,
"ClientID": 747,
"GroupID": 7990,
"Tag": [],
"Groups": [
{
"ID": 7990,
"Name": "Default Group"
}
],
"Ticket": [],
"Icon": [
{
"Type": "WEBINSPECT",
"OverlayText": null
},
{
"Type": "OWASP",
"OverlayText": "A6"
},
{
"Type": "OWASP",
"OverlayText": "A5"
},
{
"Type": "OWASP",
"OverlayText": "A1"
},
{
"Type": "OWASP",
"OverlayText": "A2"
},
{
"Type": "OWASP",
"OverlayText": "A3"
},
{
"Type": "OWASP",
"OverlayText": "A7"
},
{
"Type": "WASC",
"OverlayText": "Directory Indexing"
},
{
"Type": "WASC",
"OverlayText": "Information Leakage"
},
{
"Type": "WASC",
"OverlayText": "Path Traversal"
},
{
"Type": "WASC",
"OverlayText": "Predictable Resource Location"
},
{
"Type": "WASC",
"OverlayText": "Insufficient Authentication"
},
{
"Type": "WASC",
"OverlayText": "Insufficient Authorization"
},
{
"Type": "WASC",
"OverlayText": "LDAP Injection"
},
{
"Type": "WASC",
"OverlayText": "Cross-site Request Forgery"
},
{
"Type": "WASC",
"OverlayText": "Cross-site Scripting"
},
{
"Type": "WASC",
"OverlayText": "OS Commanding"
},
{
"Type": "WASC",
"OverlayText": "Improper Output Handling"
},
{
"Type": "WASC",
"OverlayText": "Buffer Overflow"
}
],
"Info": 0,
"DiscoveredOn": "2019-06-12",
"HostID": null,
"Name": "http://zero.webappsecurity.com:80",
"NoteCount": 0,
"Uri": "http://zero.webappsecurity.com:80",
"GroupName": "Default Group",
"ID": 19396,
"CMDB": {
"MacAddress": null,
"SupportGroup": null,
"SysID": null,
"HipaaComplianceAsset": false,
"OperatingSystem": null,
"ManufacturedBy": null,
"ManagedBy": null,
"Location": null,
"OwnedBy": null,
"Model": null,
"LastScanDate": null,
"FerpaComplianceAsset": false,
"SupportedBy": null,
"PciComplianceAsset": false
},
"UrlCount": 152,
"High": 0,
"Href": "http://platform.risksense.com/api/v1/client/747/application/search?page=0&size=3&sort=findingsDistribution.total,desc",
"LastFoundOn": "2019-06-11",
"Total": 184
},
{
"Network": {
"Type": "IP",
"ID": 91502,
"Name": "App-data"
},
"Note": [],
"Source": [
{
"ScannerType": "DAST",
"Name": "IBMAPPSCANENTERPRISE",
"UuID": "IBMAPPSCANENTERPRISE"
}
],
"Critical": 28,
"Low": 13,
"TagCount": 0,
"Medium": 0,
"Description": null,
"ClientID": 747,
"GroupID": 7990,
"Tag": [],
"Groups": [
{
"ID": 7990,
"Name": "Default Group"
}
],
"Ticket": [],
"Icon": [
{
"Type": "IBM_APP_SCANNER",
"OverlayText": null
}
],
"Info": 0,
"DiscoveredOn": "2019-06-12",
"HostID": null,
"Name": "https:/test.thatcompany.com",
"NoteCount": 0,
"Uri": "https:/test.thatcompany.com",
"GroupName": "Default Group",
"ID": 19395,
"CMDB": {
"MacAddress": null,
"SupportGroup": null,
"SysID": null,
"HipaaComplianceAsset": false,
"OperatingSystem": null,
"ManufacturedBy": null,
"ManagedBy": null,
"Location": null,
"OwnedBy": null,
"Model": null,
"LastScanDate": null,
"FerpaComplianceAsset": false,
"SupportedBy": null,
"PciComplianceAsset": false
},
"UrlCount": 33,
"High": 0,
"Href": "http://platform.risksense.com/api/v1/client/747/application/search?page=0&size=3&sort=findingsDistribution.total,desc",
"LastFoundOn": "2019-06-11",
"Total": 41
}
]
}
Human Readable Output
Total applications: 7 Page: 0/2 Client: The Demo Client
RiskSense application(s) details
| ID | Address | Name | Network | Total Findings | Critical Findings | High Findings | Medium Findings | Low Findings | Info Findings | Groups | URLs | Tags | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 19391 | RS TestApp 1 | RS TestApp 1 | App-data | 325 | 2 | 20 | 281 | 21 | 1 | 1 | 74 | 0 | 1 |
| 19396 | http://zero.webappsecurity.com:80 | http://zero.webappsecurity.com:80 | App-data | 184 | 19 | 0 | 8 | 157 | 0 | 1 | 152 | 0 | 0 |
| 19395 | https:/test.thatcompany.com | https:/test.thatcompany.com | App-data | 41 | 28 | 0 | 0 | 13 | 0 | 1 | 33 | 0 | 0 |
7. risksense-get-host-finding-detail
Gets in-depth details of a single host finding. The command accepts the host finding ID as an argument.
Base Command
risksense-get-host-finding-detail
Input
| Argument Name | Description | Required |
|---|---|---|
| hostfinding_id | The unique host finding ID. The host finding ID is either known by RiskSense users or it can be found in the human-readable output or context data(RiskSense.HostFinding.ID) after executing ‘risksense-get-host-findings’ command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| RiskSense.HostFinding.ID | String | The unique ID of the host finding. |
| RiskSense.HostFinding.Source | String | Host discovered by the scanner. |
| RiskSense.HostFinding.SourceID | String | Scanner ID of the discovered scanner. |
| RiskSense.HostFinding.Title | String | The title of the host finding. |
| RiskSense.HostFinding.Port | Number | The port number of the host finding. |
| RiskSense.HostFinding.GroupCount | Number | The total number of groups for the host finding. |
| RiskSense.HostFinding.Group.ID | Number | The unique ID of the group associated with the host finding. |
| RiskSense.HostFinding.Group.Name | String | The name of the group associated with the host finding. |
| RiskSense.HostFinding.GroupID | Number | The unique ID of the group associated with the host finding. |
| RiskSense.HostFinding.GroupName | String | The name of the group associated with the host finding. |
| RiskSense.HostFinding.HostID | Number | The unique ID of the host associated with the host finding. |
| RiskSense.HostFinding.HostName | String | The hostname of the host associated with the host finding. |
| RiskSense.HostFinding.HostIpAddress | String | The IP address of the host associated with the host finding. |
| RiskSense.HostFinding.Host.Criticality | Number | The criticality of the host associated with the host finding. |
| RiskSense.HostFinding.Host.External | boolean | Whether the host is external. |
| RiskSense.HostFinding.Host.Port.ID | Number | The unique ID of the host(s) port associated with the host finding. |
| RiskSense.HostFinding.Host.Port.Number | Number | The port number of the host associated with the host finding. |
| RiskSense.HostFinding.Host.Rs3 | Number | The Asset Security Score calculated by the RiskSense platform (includes vulnerability risk on related web applications). |
| RiskSense.HostFinding.Network.ID | Number | The network ID of the host finding. |
| RiskSense.HostFinding.Network.Name | String | The name of the network used by the host finding. |
| RiskSense.HostFinding.Network.Type | String | The type of the network used by the host finding. |
| RiskSense.HostFinding.Assessment.ID | Number | The assessment ID of the host finding. |
| RiskSense.HostFinding.Assessment.Name | String | The name of the assessment associated with the host finding. |
| RiskSense.HostFinding.Assessment.Date | String | The time when the assessment is created. |
| RiskSense.HostFinding.Vulnerability.Cve | String | The name of the Common Vulnerabilities and Exposures associated with the host finding. |
| RiskSense.HostFinding.Vulnerability.BaseScore | Number | CVE Score. |
| RiskSense.HostFinding.Vulnerability.ThreatCount | Number | The total number of threats associated with the host finding. |
| RiskSense.HostFinding.Vulnerability.AttackVector | String | Vector information in which the host finding was attacked. |
| RiskSense.HostFinding.Vulnerability.AccessComplexity | String | Complexity level. |
| RiskSense.HostFinding.Vulnerability.Authentication | String | Authentication value represents attackers authorization to get network access. |
| RiskSense.HostFinding.Vulnerability.ConfidentialityImpact | String | Confidentiality impact measures the potential impact on the confidentiality of a successfully exploited misuse vulnerability. |
| RiskSense.HostFinding.Vulnerability.Integrity | String | Integrity refers to the level of trust and veracity of the information. |
| RiskSense.HostFinding.Vulnerability.AvailabilityImpact | String | Availability refers to accessibility of network resources. |
| RiskSense.HostFinding.Vulnerability.Trending | boolean | Whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending. |
| RiskSense.HostFinding.Vulnerability.VulnLastTrendingOn | String | Date when the last trending vulnerability was found. |
| RiskSense.HostFinding.ThreatCount | Number | The total number of threats. |
| RiskSense.HostFinding.Threat.Title | String | The title of the threat. |
| RiskSense.HostFinding.Threat.Category | String | The category of the threat. |
| RiskSense.HostFinding.Threat.Severity | String | The severity level of the threat. |
| RiskSense.HostFinding.Threat.Description | String | The threat description. |
| RiskSense.HostFinding.Threat.Cve | Unknown | The Common Vulnerabilities and Exposures name of the threat. |
| RiskSense.HostFinding.Threat.Source | String | The source of the threat. |
| RiskSense.HostFinding.Threat.Published | String | The time when threat was published. |
| RiskSense.HostFinding.Threat.Updated | String | The time when the threat was last updated. |
| RiskSense.HostFinding.Threat.ThreatLastTrendingOn | String | The last time when the threat was trending. |
| RiskSense.HostFinding.Threat.Trending | boolean | Whether the threat is trending. |
| RiskSense.HostFinding.Patch.Name | String | The patch name of the host finding. |
| RiskSense.HostFinding.Patch.Url | String | The patch URL of the host finding. |
| RiskSense.HostFinding.TagCount | Number | The total number of tags associated with host finding. |
| RiskSense.HostFinding.Tag.ID | Number | The tag identifier of the host finding. |
| RiskSense.HostFinding.Tag.Name | String | The tag name of the host finding. |
| RiskSense.HostFinding.Tag.Category | String | The tag category of the host finding. |
| RiskSense.HostFinding.Tag.Description | String | The tag description of the host finding. |
| RiskSense.HostFinding.Tag.Created | String | The time when the tag was created. |
| RiskSense.HostFinding.Tag.Updated | String | The time when the tag was last updated. |
| RiskSense.HostFinding.Tag.Color | String | The color of the tag. |
| RiskSense.HostFinding.TagAssetCount | Number | The total number of tag assets. |
| RiskSense.HostFinding.TagAsset.ID | Number | The ID of the tag asset. |
| RiskSense.HostFinding.TagAsset.Name | String | The name of the tag asset. |
| RiskSense.HostFinding.TagAsset.Category | String | The category of the tag asset. |
| RiskSense.HostFinding.TagAsset.Description | String | The description of the tag asset. |
| RiskSense.HostFinding.TagAsset.Created | String | The time and date when the tag asset was created. |
| RiskSense.HostFinding.TagAsset.Updated | String | The time when the tag asset was last updated. |
| RiskSense.HostFinding.TagAsset.Color | String | The color name of the tag asset. |
| RiskSense.HostFinding.Output | String | The output of the host finding. |
| RiskSense.HostFinding.Severity | Number | The severity of the host finding. |
| RiskSense.HostFinding.SeverityDetail.Combined | Number | The combined name of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.Overridden | boolean | The overridden name of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.Scanner | String | The scanner of severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.CvssV2 | Number | The CVSS v2 value of severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.CvssV3 | Number | The CVSS v3 value of severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.Aggregated | Number | The aggregated value of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.State | String | The state of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.StateName | String | The state name of the severity detail for the host finding. |
| RiskSense.HostFinding.SeverityDetail.ExpirationDate | String | The time when the severity detail expired. |
| RiskSense.HostFinding.RiskRating | Number | The risk rate of the host finding. |
| RiskSense.HostFinding.Xrs3Impact | String | The impact of xrs3 for the host finding. |
| RiskSense.HostFinding.Xrs3ImpactOnCategory | String | The category impact of xrs3 for the host finding. |
| RiskSense.HostFinding.LastFoundOn | String | The latest time when the particular host finding was found. |
| RiskSense.HostFinding.DiscoveredOn | String | The time when the host finding was discovered. |
| RiskSense.HostFinding.ResolvedOn | String | The time when the host finding was resolved. |
| RiskSense.HostFinding.ScannerName | String | The name of the scanner of the host finding. |
| RiskSense.HostFinding.FindingType | String | The finding type of the host finding. |
| RiskSense.HostFinding.MachineID | String | The machine ID of the host finding. |
| RiskSense.HostFinding.StatusEmbedded.State | String | The current state of the embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.StateName | String | The state name of the embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.StateDescription | String | The state description of the embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.Status | boolean | The status of the embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.DurationInDays | String | The time duration (in days) of the embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.DueDate | String | The due date of embedded status associated with the host finding. |
| RiskSense.HostFinding.StatusEmbedded.ExpirationDate | String | The time when status is expired associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReportCount | Number | The total number of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.ID | Number | The ID of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.Title | String | The title of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.Label | String | The label of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.Pii | String | The pii number of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.Source | String | The source of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.ManualFindingReport.IsManualExploit | boolean | To check whether manual finding report is exploit or not. |
| RiskSense.HostFinding.ManualFindingReport.EaseOfExploit | String | The total number of manual finding reports associated with the host finding. |
| RiskSense.HostFinding.NoteCount | Number | Number of notes found. |
| RiskSense.HostFinding.Note.Date | String | The time when the note was added by the user for the host finding. |
| RiskSense.HostFinding.Note.Note | String | The notes that are added by the user for the host finding. |
| RiskSense.HostFinding.Note.UserID | Number | The User ID of the user who added a note for the host finding. |
| RiskSense.HostFinding.Note.UserName | String | The username of the user who added a note for the host finding. |
| RiskSense.HostFinding.Assignment.ID | Number | The unique ID of the assignment associated with the host finding. |
| RiskSense.HostFinding.Assignment.FirstName | String | The first name of the assigned user for the host finding. |
| RiskSense.HostFinding.Assignment.LastName | String | The last name of the assigned user for the host finding. |
| RiskSense.HostFinding.Assignment.ReceiveEmails | boolean | Indicates whether email is received or not. |
| RiskSense.HostFinding.Assignment.Email | String | The email of the assigned user for the host finding. |
| RiskSense.HostFinding.Assignment.Username | String | The username of the assigned user for the host finding. |
| RiskSense.HostFinding.Services | String | The name of the services for the host finding. |
| Ticket.ID | String | The ID of the ticket associated with the host finding. |
| Ticket.State | String | The state of the ticket associated with the host finding. |
| Host.Hostname | String | The hostname of the host. |
| Host.ID | String | The unique ID within the tool retrieving the host. |
| Host.IP | String | The IP address of the host. |
| CVE.ID | String | Common Vulnerabilities and Exposures ID. |
| CVE.Description | String | Description about the CVE. |
| CVE.CVSS | String | The CVSS represents the severity of the risk (informational, low, medium, high, critical). |
| RiskSense.HostFinding.Ticket.TicketNumber | String | The number of the ticket associated with the host finding. |
| RiskSense.HostFinding.Ticket.TicketStatus | String | The status of the ticket associated with the host finding. |
| RiskSense.HostFinding.Ticket.DeepLink | String | The deeplink associated with the ticket associated with the host finding. |
| RiskSense.HostFinding.Ticket.Type | String | The type of the ticket associated with the host finding. |
| RiskSense.HostFinding.Ticket.ConnectorName | String | The connector name of the ticket associated with the host finding. |
| RiskSense.HostFinding.Ticket.DetailedStatus | String | The detailed status of the ticket associated with the host finding. |
Command Example
!risksense-get-host-finding-detail hostfinding_id=115469504
Context Example
{
"RiskSense.HostFinding": [
{
"HostID": 3569980,
"HostName": "lmd.ql.nl",
"HostIpAddress": "31.207.62.145",
"ID": 115469504,
"Source": "QUALYS",
"SourceID": "QUALYS38574",
"Title": "Solaris 10 and Solaris 11 (SolarisExpress) Remote Access Telnet Daemon Flaw",
"Port": null,
"GroupCount": 1,
"Group": [
{
"ID": 7990,
"Name": "Default Group"
}
],
"Host": {
"Criticality": 5,
"External": true,
"Port": [
{
"ID": 42841324,
"Number": 21
},
{
"ID": 42841352,
"Number": 22
},
{
"ID": 42841261,
"Number": 23
},
{
"ID": 42841311,
"Number": 25
},
{
"ID": 42841250,
"Number": 111
},
{
"ID": 42841211,
"Number": 123
},
{
"ID": 42841239,
"Number": 587
},
{
"ID": 42841345,
"Number": 852
},
{
"ID": 42841176,
"Number": 4045
},
{
"ID": 42841331,
"Number": 6112
},
{
"ID": 42841226,
"Number": 6481
},
{
"ID": 42841297,
"Number": 7100
},
{
"ID": 42841170,
"Number": 8400
},
{
"ID": 42841182,
"Number": 8402
},
{
"ID": 42841359,
"Number": 32771
},
{
"ID": 42841189,
"Number": 32772
},
{
"ID": 42841340,
"Number": 32775
},
{
"ID": 42841196,
"Number": 32776
},
{
"ID": 42841476,
"Number": 32777
},
{
"ID": 42841287,
"Number": 32778
},
{
"ID": 42841363,
"Number": 32780
},
{
"ID": 42841302,
"Number": 32794
}
],
"Rs3": 600
},
"Network": {
"ID": 78038,
"Name": "IP Network",
"Type": "IP"
},
"Assessment": [
{
"ID": 67442,
"Name": "First Assessment",
"Date": "2019-04-23"
}
],
"Vulnerability": [
{
"Cve": "CVE-2007-0882",
"BaseScore": 10,
"ThreatCount": 5,
"AttackVector": "Network",
"AccessComplexity": "Low",
"Authentication": "None",
"ConfidentialityImpact": "Complete",
"Integrity": "Complete",
"AvailabilityImpact": "Complete",
"Trending": false,
"VulnLastTrendingOn": null
}
],
"ThreatCount": 5,
"Threat": [
{
"Title": "Sun Solaris Telnet Remote Authentication Bypass Vulnerability",
"Category": "Exploit",
"Severity": null,
"Description": "This module exploits the argument injection vulnerability\n in the telnet daemon (in.telnetd) of Solaris 10 and 11.",
"Cve": "CVE-2007-0882",
"Source": "METASPLOIT",
"Published": "2007-02-17T00:00:00",
"Updated": "2020-02-13T15:32:52",
"ThreatLastTrendingOn": null,
"Trending": false
},
{
"Title": "Sun Solaris Telnet - Remote Authentication Bypass (Metasploit)",
"Category": "Exploit",
"Severity": null,
"Description": "Sun Solaris Telnet - Remote Authentication Bypass (Metasploit)",
"Cve": "CVE-2007-0882",
"Source": "EXPLOIT DB",
"Published": "2010-06-22T00:00:00",
"Updated": "2020-02-08T07:54:43",
"ThreatLastTrendingOn": null,
"Trending": false
},
{
"Title": "Solaris 10/11 Telnet - Remote Authentication Bypass (Metasploit)",
"Category": "Exploit",
"Severity": null,
"Description": "Solaris 10/11 Telnet - Remote Authentication Bypass (Metasploit)",
"Cve": "CVE-2007-0882",
"Source": "EXPLOIT DB",
"Published": "2007-02-12T00:00:00",
"Updated": "2020-02-08T07:54:43",
"ThreatLastTrendingOn": null,
"Trending": false
},
{
"Title": "SunOS 5.10/5.11 in.TelnetD - Remote Authentication Bypass",
"Category": "Exploit",
"Severity": null,
"Description": "SunOS 5.10/5.11 in.TelnetD - Remote Authentication Bypass",
"Cve": "CVE-2007-0882",
"Source": "EXPLOIT DB",
"Published": "2007-02-11T00:00:00",
"Updated": "2020-02-08T07:54:43",
"ThreatLastTrendingOn": null,
"Trending": false
},
{
"Title": "Solaris.Wanuk.Worm",
"Category": "Worm",
"Severity": null,
"Description": "",
"Cve": "CVE-2007-0882",
"Source": "SYMANTEC",
"Published": "2007-02-28T00:00:00",
"Updated": "2019-08-16T15:50:12",
"ThreatLastTrendingOn": null,
"Trending": false
}
],
"Patch": [],
"TagCount": 5,
"Tag": [
{
"ID": 215551,
"Name": "Data_Center_1",
"Category": "Location",
"Description": "",
"Created": "2019-04-24T21:35:12",
"Updated": "2019-06-19T19:23:08",
"Color": "#dd8361"
},
{
"ID": 215554,
"Name": "Linux_Team_2",
"Category": "People",
"Description": "",
"Created": "2019-04-24T21:39:59",
"Updated": "2019-04-24T21:39:59",
"Color": "#78a19b"
},
{
"ID": 225750,
"Name": "PCI Assets",
"Category": "Project",
"Description": "",
"Created": "2019-08-28T18:50:30",
"Updated": "2019-10-31T03:40:55",
"Color": "#648d9f"
},
{
"ID": 230966,
"Name": "CVSS_Sev_Crit_Test",
"Category": "Custom",
"Description": "CVSS Crits",
"Created": "2019-11-19T23:40:40",
"Updated": "2019-11-19T23:40:40",
"Color": "#648d9f"
},
{
"ID": 230967,
"Name": "RR_Crit_Test",
"Category": "Custom",
"Description": "Risk Rating Crit Test",
"Created": "2019-11-19T23:41:36",
"Updated": "2019-11-19T23:41:36",
"Color": "#648d9f"
}
],
"TagAssetCount": 2,
"TagAsset": [
{
"ID": 215551,
"Name": "Data_Center_1",
"Category": "Location",
"Created": "2019-04-24T21:35:12",
"Updated": "2019-06-19T19:23:08",
"Color": "#dd8361"
},
{
"ID": 215554,
"Name": "Linux_Team_2",
"Category": "People",
"Created": "2019-04-24T21:39:59",
"Updated": "2019-04-24T21:39:59",
"Color": "#78a19b"
}
],
"Output": "Detected service telnet and os SOLARIS 9-11",
"Severity": 10,
"SeverityDetail": {
"Combined": 10,
"Overridden": false,
"Scanner": "5",
"CvssV2": 10,
"CvssV3": null,
"Aggregated": 10,
"State": null,
"StateName": null,
"ExpirationDate": ""
},
"RiskRating": 10,
"Xrs3Impact": null,
"Xrs3ImpactOnCategory": null,
"LastFoundOn": "2010-07-22",
"DiscoveredOn": "2010-07-22",
"ResolvedOn": "2019-06-12",
"ScannerName": "QUALYS",
"FindingType": "Auth/Unauthenticated",
"MachineID": "",
"StatusEmbedded": {
"State": "ACCEPTED",
"StateName": "RA Approved",
"StateDescription": "Finding was approved in risk acceptance workflow",
"Status": false,
"DurationInDays": "3246",
"DueDate": "2019-12-01T00:00:00",
"ExpirationDate": ""
},
"ManualFindingReportCount": 0,
"ManualFindingReport": [],
"NoteCount": 0,
"Note": [],
"Assignment": [],
"Services": "",
"Ticket": []
}
],
"Host": [
{
"ID": 3569980,
"Hostname": "lmd.ql.nl",
"IP": "31.207.62.145"
}
],
"CVE": [
{
"ID": "CVE-2007-0882",
"CVSS": 10,
"Description": "Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client \"-f\" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account."
}
]
}
Human Readable Output
Client: The Demo Client
Group Details
Name: Default Group
Host Finding Details
| Host Name | Ip Address | Network | Source | Risk Rating | Title |
|---|---|---|---|---|---|
| lmd.ql.nl | 31.207.62.145 | IP Network | QUALYS | 10.0 | Solaris 10 and Solaris 11 (SolarisExpress) Remote Access Telnet Daemon Flaw |
Threat(s) (5)
| Title | Category | Source | CVEs | Published | Updated |
|---|---|---|---|---|---|
| Sun Solaris Telnet Remote Authentication Bypass Vulnerability | Exploit | METASPLOIT | CVE-2007-0882 | 2007-02-17T00:00:00 | 2020-02-13T15:32:52 |
| Sun Solaris Telnet - Remote Authentication Bypass (Metasploit) | Exploit | EXPLOIT DB | CVE-2007-0882 | 2010-06-22T00:00:00 | 2020-02-08T07:54:43 |
| Solaris 10/11 Telnet - Remote Authentication Bypass (Metasploit) | Exploit | EXPLOIT DB | CVE-2007-0882 | 2007-02-12T00:00:00 | 2020-02-08T07:54:43 |
| SunOS 5.10/5.11 in.TelnetD - Remote Authentication Bypass | Exploit | EXPLOIT DB | CVE-2007-0882 | 2007-02-11T00:00:00 | 2020-02-08T07:54:43 |
| Solaris.Wanuk.Worm | Worm | SYMANTEC | CVE-2007-0882 | 2007-02-28T00:00:00 | 2019-08-16T15:50:12 |
Vulnerabilities (1)
| Name | V2/Score | Threat Count | Attack Vector | Access Complexity | Authentication |
|---|---|---|---|---|---|
| CVE-2007-0882 | 10.0 | 5 | Network | Low | None |
Status
| State | Current State | Description | Duration | Due Date |
|---|---|---|---|---|
| ACCEPTED | RA Approved | Finding was approved in risk acceptance workflow | 3246 day(s) | 2019-12-01T00:00:00 |
Tag(s) (5)
| Name | Category | Created | Updated |
|---|---|---|---|
| Data_Center_1 | Location | 2019-04-24T21:35:12 | 2019-06-19T19:23:08 |
| Linux_Team_2 | People | 2019-04-24T21:39:59 | 2019-04-24T21:39:59 |
| PCI Assets | Project | 2019-08-28T18:50:30 | 2019-10-31T03:40:55 |
| CVSS_Sev_Crit_Test | Custom | 2019-11-19T23:40:40 | 2019-11-19T23:40:40 |
| RR_Crit_Test | Custom | 2019-11-19T23:41:36 | 2019-11-19T23:41:36 |
Manual Finding Report(s) (0)
No entries.
Ticket(s) (0)
No entries.
Assessment(s) (1)
| Name | Date |
|---|---|
| First Assessment | 2019-04-23 |
Host Finding Description
Solaris 10 and 11 hosts are vulnerable to a telnet daemon flaw.
The telnet daemon passes switches directly to the login process which looks for a switch that allows root to login to any account without a password. If your telnet daemon is running as root it allows unauthenticated remote logins.
Telnet poses a risk because data transferred between clients may not be encrypted. Telnet is also a frequent target for port scanners.
8. risksense-get-app-detail
Gets in-depth details of a single application. The command accepts an application ID as an argument.
Base Command
risksense-get-app-detail
Input
| Argument Name | Description | Required |
|---|---|---|
| application_id | The application ID is unique for the application. The application ID is either known by RiskSense users or it can be searched in context output (RiskSense.Application.ID) or in the human-readable output of ‘risksense-get-apps’ command. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| RiskSense.Application.ID | Number | The unique ID within the tool retrieving the application. |
| RiskSense.Application.GroupID | Number | The group ID of the application. |
| RiskSense.Application.GroupName | String | The group name of the application. |
| RiskSense.Application.Group.ID | Number | The ID of the group belonging to the Application. |
| RiskSense.Application.Group.Name | String | The name of the group belonging to the Application. |
| RiskSense.Application.Network.ID | Number | The network ID of the application. |
| RiskSense.Application.Network.Name | String | The network name of the application. |
| RiskSense.Application.Network.Type | String | The network type of the application. |
| RiskSense.Application.ClientID | Number | The client ID of the application. |
| RiskSense.Application.HostID | Number | The host ID of the application. |
| RiskSense.Application.Uri | String | The reference URI of the application. |
| RiskSense.Application.Name | String | The name of the application. |
| RiskSense.Application.Description | String | The detailed description of the application. |
| RiskSense.Application.NoteCount | Number | The total number of notes found in the application. |
| RiskSense.Application.DiscoveredOn | String | The time when the application was discovered. |
| RiskSense.Application.LastFoundOn | String | The time when the application was last found. |
| RiskSense.Application.Total | Number | The total number of open findings of the application. |
| RiskSense.Application.Critical | Number | The number of open findings of the application with critical severity. |
| RiskSense.Application.High | Number | The number of open findings of the application with high severity. |
| RiskSense.Application.Medium | Number | The number of open findings of the application with medium severity. |
| RiskSense.Application.Low | Number | The number of open findings of the application with low severity. |
| RiskSense.Application.Info | Number | The number of open findings of the application with info severity. |
| RiskSense.Application.Icon.Type | String | The icon type of the application. |
| RiskSense.Application.Icon.OverlayText | String | The overlay text of the icon of the application. |
| RiskSense.Application.TagCount | Number | The total number of tags of the application. |
| RiskSense.Application.UrlCount | Number | The total number of URLs of the application. |
| RiskSense.Application.Href | String | The deeplink pointing to the application details on RiskSense. |
| RiskSense.Application.CMDB.ManufacturedBy | String | The name of the manufacturer in configuration management DB (CMDB) from application details. |
| RiskSense.Application.CMDB.Model | String | The CMDB model name of the application. |
| RiskSense.Application.CMDB.MacAddress | String | The CMDB MAC Address of the application. |
| RiskSense.Application.CMDB.Location | String | The CMDB location of the application. |
| RiskSense.Application.CMDB.ManagedBy | String | The CMDB entity name that managed the application. |
| RiskSense.Application.CMDB.OwnedBy | String | The CMDB entity name that owned the application. |
| RiskSense.Application.CMDB.SupportedBy | String | The CMDB entity name that supported the application |
| RiskSense.Application.CMDB.SupportGroup | String | The CMDB supporting group of the application. |
| RiskSense.Application.CMDB.SysID | String | The CMDB system ID of the application. |
| RiskSense.Application.CMDB.OperatingSystem | String | The CMDB Operating system of the application. |
| RiskSense.Application.CMDB.LastScanDate | String | The CMDB last scan date of the application. |
| RiskSense.Application.CMDB.FerpaComplianceAsset | Boolean | The Family Educational Rights and Privacy Act. |
| RiskSense.Application.CMDB.HipaaComplianceAsset | Boolean | Health Insurance Portability and Accountability Act. |
| RiskSense.Application.CMDB.PciComplianceAsset | String | The Payment Card Industry (PCI) Council continues to make changes to ensure that their standards are up to date with emerging threats and changes in the market. |
| RiskSense.Application.Ticket.TicketNumber | String | The number of the ticket associated with the application. |
| RiskSense.Application.Ticket.TicketStatus | String | The status of the ticket associated with the application. |
| RiskSense.Application.Ticket.Type | String | The type of the ticket associated with the application. |
| RiskSense.Application.Ticket.ConnectorName | String | The connector name of the ticket associated with the application. |
| RiskSense.Application.Ticket.DetailedStatus | String | The detailed status of ticket associated with the application. |
| RiskSense.Application.Ticket.DeepLink | String | The deeplink associated with the ticket associated with the application. |
| RiskSense.Application.Source.Name | String | The name of the source associated with the application. |
| RiskSense.Application.Source.UuID | String | The unique ID of the source associated with the application. |
| RiskSense.Application.Source.ScannerType | String | The type of scanner of the source associated with the application.. |
| RiskSense.Application.Note.UserID | String | The user ID of the user who added a note for the application. |
| RiskSense.Application.Note.UserName | String | The username of the user who added a note for the application. |
| RiskSense.Application.Note.Note | String | The notes that are added by the user for the application. |
| RiskSense.Application.Note.Date | String | The time when the note was added by the user for the application. |
| RiskSense.Application.Tag.ID | Number | The ID of the tag. |
| RiskSense.Application.Tag.Name | String | The name of the tag. |
| RiskSense.Application.Tag.Category | String | The category of the tag. |
| RiskSense.Application.Tag.Description | String | The description of the tag. |
| RiskSense.Application.Tag.Created | String | The time when the tag was created. |
| RiskSense.Application.Tag.Updated | String | The time when the tag was last updated. |
| RiskSense.Application.Tag.Color | String | The color code of the tag of the application. |
| Ticket.ID | String | The ID of the ticket associated with the application. |
| Ticket.State | String | The state of the ticket associated with the application. |
Command Example
!risksense-get-app-detail application_id=19394
Context Example
{
"RiskSense.Application": [
{
"Network": {
"Type": "IP",
"ID": 91502,
"Name": "App-data"
},
"Note": [
{
"Date": "2020-01-15T23:16:12",
"Note": "Add note to app",
"UserID": 2222,
"UserName": "Natalia Donaldson"
},
{
"Date": "2020-01-15T23:26:43",
"Note": "Add note to app",
"UserID": 2222,
"UserName": "Natalia Donaldson"
},
{
"Date": "2020-01-17T05:00:12",
"Note": "Add note to app",
"UserID": 2222,
"UserName": "Natalia Donaldson"
}
],
"Source": [
{
"ScannerType": "DAST",
"Name": "IBMAPPSCANENTERPRISE",
"UuID": "IBMAPPSCANENTERPRISE"
}
],
"Critical": 0,
"Low": 15,
"TagCount": 1,
"Medium": 0,
"Description": null,
"ClientID": 747,
"GroupID": 7990,
"Tag": [
{
"Category": "Project",
"Updated": "2020-01-17T23:59:22",
"Name": "PCI Orch Test ",
"Created": "2020-01-17T23:59:22",
"Color": "#af3a29",
"ID": 234039,
"Description": "PCI Orch Test"
}
],
"Groups": [
{
"ID": 7990,
"Name": "Default Group"
}
],
"Ticket": [],
"Icon": [
{
"Type": "IBM_APP_SCANNER",
"OverlayText": null
}
],
"Info": 0,
"DiscoveredOn": "2019-06-12",
"HostID": null,
"Name": "https://freebirddemo.dev.ccs.thatcompany.net",
"NoteCount": 3,
"Uri": "https://freebirddemo.dev.ccs.thatcompany.net",
"GroupName": "Default Group",
"ID": 19394,
"CMDB": {
"MacAddress": null,
"SupportGroup": null,
"SysID": null,
"HipaaComplianceAsset": false,
"OperatingSystem": null,
"ManufacturedBy": null,
"ManagedBy": null,
"Location": null,
"OwnedBy": null,
"Model": null,
"LastScanDate": null,
"FerpaComplianceAsset": false,
"SupportedBy": null,
"PciComplianceAsset": false
},
"UrlCount": 15,
"High": 0,
"Href": "http://platform.risksense.com/api/v1/client/747/application/search?page=0&size=20&sort=id,asc",
"LastFoundOn": "2019-06-11",
"Total": 15
}
]
}
Human Readable Output
Client: The Demo Client
Group Details
Name: Default Group
Sources
Scanner(s): IBMAPPSCANENTERPRISE
Application Details
| Address | Name | Network Name | Network Type | Discovered On | Last Found On |
|---|---|---|---|---|---|
| https://freebirddemo.dev.ccs.thatcompany.net | https://freebirddemo.dev.ccs.thatcompany.net | App-data | IP | 2019-06-12 | 2019-06-11 |
Findings Distribution
| Total | Critical | High | Medium | Low | Info |
|---|---|---|---|---|---|
| 15 | 0 | 0 | 0 | 15 | 0 |
Tag(s) (1)
| Name | Category | Description | Created | Updated |
|---|---|---|---|---|
| PCI Orch Test | Project | PCI Orch Test | 2020-01-17T23:59:22 | 2020-01-17T23:59:22 |
Ticket(s) (0)
No entries.
8. risksense-apply-tag
Apply the new or existing tag to the asset, creates a new tag if it does not exist in RiskSense.
Base Command
risksense-apply-tag
Input
| Argument Name | Description | Required |
|---|---|---|
| tagname | Tag name which applies to the asset(s). | Required |
| assettype | Type of asset available in RiskSense to apply the tag. Apart from the available choices, you can provide the asset type supported by RiskSense API. | Required |
| propagate_to_all_findings | If the given argument is set to true, then it applies the tag to assets as well as findings of assets. Note - It only works if the tag with the given name does not exist. | Optional |
| fieldname | The RiskSense asset attribute by which to filter the assets to apply the tag. It can be an attribute of Host, Application, Host Finding, Application Finding. If specified, the ‘value’ argument is mandatory. | Optional |
| operator | The match operator should be applied for filtering the assets to apply the tag based on ‘fieldname’ and ‘value’. Can be ‘EXACT’ - filter records exactly matching the criteria; ‘IN’ - filter records matching any one of the comma-separated values; ‘LIKE’ - filter records with the value matching the specified pattern. All the records fieldname value contains the string provided in value; ‘BETWEEN’ - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. | Optional |
| exclude | The exclude flag that determines whether to apply the tag on assets matches filter criteria or not. Default set to false. If set to true, tag applied on an asset not matching the specified values. | Optional |
| value | The value of the asset property mentioned in ‘fieldname’ to be considered for filter criteria. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| RiskSense.TagAssociation.TagName | String | Name of the tag. |
| RiskSense.TagAssociation.AssociationID | Number | Tag association ID. |
| RiskSense.TagAssociation.Created | String | The time when the tag was associated. |
Command Example
!risksense-apply-tag tagname="Test" assettype="host"
Context Example
{
"RiskSense.TagAssociation":
{
"AssociationID": 2542063,
"Created": "2020-04-29T08:46:54",
"TagName": "Test"
}
}
Human Readable Output
Test tag applied to given asset(s).
Configuration parameters
url— URL (required)api_key— API Key (required)client_name— Client Name (required)request_timeout— HTTP Request Timeout (Specify the time interval in seconds. All the RiskSense API calls would timeout if the response is not returned within the configured time interval).insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (9)
-
risksense-apply-tagApply the new or existing tag to the asset, creates a new tag if it does not exist in RiskSense.
-
risksense-get-app-detailGets in-depth details of a single application. The command accepts an application ID as an argument.
-
risksense-get-appsLooks up the application details. The application details can be searched based on input parameters like fieldname (Name, Network, Address), operator (EXACT, IN, LIKE, BETWEEN), page, size, sort by and sort direction.
-
risksense-get-host-detailGets in-depth details of a single host. This command accepts either hostname or host ID as an argument.
-
risksense-get-host-finding-detailGets in-depth details of a single host finding. The command accepts the host finding ID as an argument.
-
risksense-get-host-findingsA detailed host finding view with the severity level. Displays vulnerability information like CVE, Threats associated with current findings and origin of findings.
-
risksense-get-hostsGets details of the supplied host. The host details can be searched based on input parameters like fieldname (Host Name, IP Address, Criticality, etc), operator (EXACT, IN, LIKE, BETWEEN), page, size, sort by and sort direction.
-
risksense-get-unique-cvesLooks up vulnerability details for the supplied host finding with its base score.
-
risksense-get-unique-open-findingsFinds unique open host findings.The open findings can be searched based on input parameters like fieldname (Severity, Title, Source etc), operator (EXACT, IN, LIKE, BETWEEN), page and size.
commonfields: id: RiskSense version: -1 name: RiskSense display: RiskSense category: Vulnerability Management provider: Ivanti description: RiskSense is a cloud-based platform that provides vulnerability management and prioritization to measure and control cybersecurity risk. configuration: - display: URL name: url defaultvalue: https://platform.risksense.com type: 0 required: true - display: API Key name: api_key defaultvalue: "" type: 4 required: true - display: Client Name name: client_name defaultvalue: "" type: 0 required: true - display: HTTP Request Timeout (Specify the time interval in seconds. All the RiskSense API calls would timeout if the response is not returned within the configured time interval). name: request_timeout defaultvalue: 60 type: 0 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false script: script: '' commands: - name: risksense-get-hosts arguments: - name: fieldname auto: PREDEFINED predefined: - Host Name - IP Address - Criticality description: The RiskSense host attribute by which to filter the results. Can be 'Host Name', 'IP Address', or 'Criticality'. Apart from the available choices, you can provide the attributes supported by RiskSense API. Refer to the API /host/filter API to get the list of supported attributes. The uid of filter attributes must be provided here, for example, assessment_labels, asset_tags, cvss3BaseI, etc. If specified, 'value' argument is mandatory. - name: operator auto: PREDEFINED predefined: - EXACT - IN - LIKE - BETWEEN description: The match operator should be applied for filtering the hosts based on 'fieldname' and 'value'. Can be 'EXACT' - filter records exactly matching the criteria; 'IN' - filter records matching any one of the comma-separated values; 'LIKE' - filter records with the value matching the specified pattern. All the records fieldname value contains the string provided in value; 'BETWEEN' - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. - name: exclude auto: PREDEFINED predefined: - 'true' - 'false' description: The exclude flag that determines whether the returned records matches filter criteria or not. The default set is false. If set to True, host not matching the specified values are fetched. - name: value description: The value of the host property mentioned in 'fieldname' to be considered for filter criteria. isArray: true - name: page description: The index of the page. The index is a numeric value starting with 0. defaultValue: 0 - name: size description: The maximum number of records to fetch in one page. defaultValue: 10 - name: sort_by auto: PREDEFINED predefined: - Total Findings - Critical Findings - High Findings - Medium Findings - Low Findings - Info Findings - RS3 description: The fieldname by which to sort the returned records. defaultValue: RS3 - name: sort_direction auto: PREDEFINED predefined: - Ascending - Descending description: The sorting direction to apply to returned records. defaultValue: Ascending outputs: - contextPath: Host.Hostname description: The hostname of the host. type: String - contextPath: Host.ID description: The unique ID within the tool retrieving the host. type: String - contextPath: Host.IP description: The IP address of the host. type: String - contextPath: Host.OS description: The operating system of the host. type: String - contextPath: RiskSense.Host.ID description: The unique identifier of the host. type: Number - contextPath: RiskSense.Host.ClientID description: The client id of the host. type: Number - contextPath: RiskSense.Host.GroupID description: The ID of the group belonging to the host. type: Number - contextPath: RiskSense.Host.GroupName description: The name of the group belonging to the host. type: String - contextPath: RiskSense.Host.Group.ID description: The ID of the group belonging to the host. type: Number - contextPath: RiskSense.Host.Group.Name description: The name of the group belonging to the host. type: String - contextPath: RiskSense.Host.Rs3 description: The asset security score calculated by the RiskSense platform (includes vulnerability risk on related web applications). type: Number - contextPath: RiskSense.Host.Xrs3 description: The asset security score calculated by the RiskSense platform (includes vulnerability risk on related web applications). type: String - contextPath: RiskSense.Host.Criticality description: The asset importance using a scale of 1 (lowest importance) to 5 (highest importance). type: Number - contextPath: RiskSense.Host.Tag.ID description: The ID of the tag. type: Number - contextPath: RiskSense.Host.Tag.Name description: The name of the tag. type: String - contextPath: RiskSense.Host.Tag.Category description: The category of the tag. type: String - contextPath: RiskSense.Host.Tag.Description description: The description of the tag. type: String - contextPath: RiskSense.Host.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.Host.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.Host.Tag.Color description: The color code of the tag. type: String - contextPath: RiskSense.Host.NetworkID description: The Network ID of the host. type: Number - contextPath: RiskSense.Host.NetworkName description: The name of the network used by the host. type: String - contextPath: RiskSense.Host.NetworkType description: The type of the network used by the host. type: String - contextPath: RiskSense.Host.DiscoveredOn description: The time when the host was discovered. type: String - contextPath: RiskSense.Host.LastFoundOn description: The time when the host was last found. type: String - contextPath: RiskSense.Host.LastScanTime description: The last time when the host was last scanned. type: String - contextPath: RiskSense.Host.HostName description: The hostname of the host. type: String - contextPath: RiskSense.Host.IpAddress description: The IP address of the host. type: String - contextPath: RiskSense.Host.PortNumbers description: The list of ports that are currently bound. type: String - contextPath: RiskSense.Host.OS.Name description: The operating system of the host. type: String - contextPath: RiskSense.Host.OS.Family description: The family of the operating system of the host. type: String - contextPath: RiskSense.Host.OS.Class description: The class of the operating system of the host. type: String - contextPath: RiskSense.Host.OS.Vendor description: The vendor information of the operating system of the host. type: String - contextPath: RiskSense.Host.CMDB.Order description: The CMDB order number of the host. type: Number - contextPath: RiskSense.Host.CMDB.Key description: The CMDB key identifier of the host. type: String - contextPath: RiskSense.Host.CMDB.Value description: The CMDB value identifier of the host. type: String - contextPath: RiskSense.Host.CMDB.Label description: The CMDB label identifier of the host. type: String - contextPath: RiskSense.Host.Services description: The name of the services which are used by the host. type: String - contextPath: RiskSense.Host.Note.UserID description: The User ID of the user who added a note for the host. type: String - contextPath: RiskSense.Host.Note.UserName description: The username of the user who added a note for the host. type: String - contextPath: RiskSense.Host.Note.Note description: The notes that are added by the user for the host. type: String - contextPath: RiskSense.Host.Note.Date description: The time when the note was added by the user for the host. type: String - contextPath: RiskSense.Host.Source.Name description: The name of the source associated with the host. type: String - contextPath: RiskSense.Host.Source.UuID description: The unique ID of the source associated with the host. type: String - contextPath: RiskSense.Host.Source.ScannerType description: The type of scanner that discovered the host. type: String - contextPath: RiskSense.Host.Ticket.TicketNumber description: The number of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.TicketStatus description: The status of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.DeepLink description: The deeplink associated with the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.Type description: The type of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.ConnectorName description: The connector name of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.DetailedStatus description: The detailed status of the ticket associated with the host. type: String - contextPath: RiskSense.Host.LastVulnTrendingOn description: The time when the last vulnerability was trending on the host. type: String - contextPath: RiskSense.Host.LastThreatTrendingOn description: The time when the last threat was trending on the host. type: String - contextPath: RiskSense.Host.OldestOpenFindingWithThreatDiscoveredOn description: The timestamp when the oldest open finding with the threat was discovered. type: String - contextPath: RiskSense.Host.Xrs3date description: The time when the xrs3 is calculated by RiskSense platform. type: String - contextPath: RiskSense.Host.DiscoveredByRS description: The flag that determines whether the host is discovered by the RiskSense platform or not. type: String - contextPath: RiskSense.Host.Href description: The deeplink pointing to the host details on RiskSense. type: String - contextPath: RiskSense.Host.Total description: The number of total open findings of the host. type: Number - contextPath: RiskSense.Host.Critical description: The number of open findings of the host with critical severity. type: Number - contextPath: RiskSense.Host.High description: The number of open findings of the host with high severity. type: Number - contextPath: RiskSense.Host.Medium description: The number of open findings of the host with medium severity. type: Number - contextPath: RiskSense.Host.Low description: The number of open findings of the host with low severity. type: Number - contextPath: RiskSense.Host.Info description: The number of open findings of the host with info severity. type: Number - contextPath: Ticket.ID description: The ID of the ticket associated with the host. type: String - contextPath: Ticket.State description: The state of the ticket associated with the host. type: String description: Gets details of the supplied host. The host details can be searched based on input parameters like fieldname (Host Name, IP Address, Criticality, etc), operator (EXACT, IN, LIKE, BETWEEN), page, size, sort by and sort direction. - name: risksense-get-host-detail arguments: - name: host_id description: The unique host ID of the host. The host ID is either known by RiskSense users or it can be searched in context output (RiskSense.Host.ID) or in the human-readable output of 'risksense-get-hosts' command. - name: host description: The hostname of the host. The hostname is either known by RiskSense users or it can be searched in context output (RiskSense.Host.HostName) or in the human-readable output of 'risksense-get-hosts' command. outputs: - contextPath: Host.Hostname description: The hostname of the host. type: String - contextPath: Host.ID description: The unique ID within the tool retrieving the host. type: String - contextPath: Host.IP description: The IP address of the host. type: String - contextPath: Host.OS description: The operating system of the host. type: String - contextPath: RiskSense.Host.ID description: The unique identifier of the host. type: Number - contextPath: RiskSense.Host.ClientID description: The client ID of the host. type: Number - contextPath: RiskSense.Host.GroupID description: The ID of the group belonging to the host. type: Number - contextPath: RiskSense.Host.GroupName description: The name of the group belonging to the host. type: String - contextPath: RiskSense.Host.Group.ID description: The ID of the group belonging to the host. type: Number - contextPath: RiskSense.Host.Group.Name description: The name of the group belonging to the host. type: String - contextPath: RiskSense.Host.Rs3 description: The asset security score calculated by the RiskSense platform (includes vulnerability risk on related web applications). type: Number - contextPath: RiskSense.Host.Xrs3 description: The asset security score calculated by RiskSense platform. type: String - contextPath: RiskSense.Host.Criticality description: The asset importance using a scale of 1 (lowest importance) to 5 (highest importance). type: Number - contextPath: RiskSense.Host.Tag.ID description: The ID of the tag. type: Number - contextPath: RiskSense.Host.Tag.Name description: The name of the tag. type: String - contextPath: RiskSense.Host.Tag.Category description: The category of the tag. type: String - contextPath: RiskSense.Host.Tag.Description description: The description of the tag. type: String - contextPath: RiskSense.Host.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.Host.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.Host.Tag.Color description: The color code of the tag. type: String - contextPath: RiskSense.Host.NetworkID description: The network ID of the host. type: Number - contextPath: RiskSense.Host.NetworkName description: The name of the network used by the host. type: String - contextPath: RiskSense.Host.NetworkType description: The type of the network used by the host. type: String - contextPath: RiskSense.Host.DiscoveredOn description: The time when the host was discovered. type: String - contextPath: RiskSense.Host.LastFoundOn description: The time when the host was last found. type: String - contextPath: RiskSense.Host.LastScanTime description: The last time when the host was last scanned. type: String - contextPath: RiskSense.Host.HostName description: The hostname of the host. type: String - contextPath: RiskSense.Host.IpAddress description: The IP address of the host. type: String - contextPath: RiskSense.Host.PortNumbers description: The list of ports that are currently bound. type: String - contextPath: RiskSense.Host.OS.Name description: The operating system of the host. type: String - contextPath: RiskSense.Host.OS.Family description: The family of the operating system of the host. type: String - contextPath: RiskSense.Host.OS.Class description: The class of the operating system of the host. type: String - contextPath: RiskSense.Host.OS.Vendor description: The vendor information of the operating system of the host. type: String - contextPath: RiskSense.Host.CMDB.Order description: The CMDB order number of the host. type: Number - contextPath: RiskSense.Host.CMDB.Key description: The CMDB key identifier of the host. type: String - contextPath: RiskSense.Host.CMDB.Value description: The CMDB value identifier of the host. type: String - contextPath: RiskSense.Host.CMDB.Label description: The CMDB label identifier of the host. type: String - contextPath: RiskSense.Host.Services description: The name of the services which are used by the host. type: String - contextPath: RiskSense.Host.Note.UserID description: The User ID of the user who added a note for the host. type: String - contextPath: RiskSense.Host.Note.UserName description: The username of the user who added a note for the host. type: String - contextPath: RiskSense.Host.Note.Note description: The notes that are added by the user for the host. type: String - contextPath: RiskSense.Host.Note.Date description: The time when the note was added by the user for the host. type: String - contextPath: RiskSense.Host.Source.Name description: The name of the source associated with the host. type: String - contextPath: RiskSense.Host.Source.UuID description: The unique ID of the source associated with the host. type: String - contextPath: RiskSense.Host.Source.ScannerType description: The type of scanner that discovered the host. type: String - contextPath: RiskSense.Host.Ticket.TicketNumber description: The number of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.TicketStatus description: The status of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.DeepLink description: The deeplink of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.Type description: The type of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.ConnectorName description: The connector name of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.DetailedStatus description: The detailed status of the ticket associated with the host. type: String - contextPath: RiskSense.Host.LastVulnTrendingOn description: The time when the last vulnerability was trending on the host. type: String - contextPath: RiskSense.Host.LastThreatTrendingOn description: The time when the last threat was trending on the host. type: String - contextPath: RiskSense.Host.OldestOpenFindingWithThreatDiscoveredOn description: The timestamp when the oldest open finding with the threat was discovered. type: String - contextPath: RiskSense.Host.Xrs3date description: The time when the xrs3 is calculated by RiskSense platform. type: String - contextPath: RiskSense.Host.DiscoveredByRS description: The flag that determines whether the host is discovered by the RiskSense platform or not. type: String - contextPath: RiskSense.Host.Href description: The deeplink pointing to the host details on RiskSense. type: String - contextPath: RiskSense.Host.Total description: The number of total open findings of the host. type: Number - contextPath: RiskSense.Host.Critical description: The number of open findings of the host with critical severity. type: Number - contextPath: RiskSense.Host.High description: The number of open findings of the host with high severity. type: Number - contextPath: RiskSense.Host.Medium description: The number of open findings of the host with medium severity. type: Number - contextPath: RiskSense.Host.Low description: The number of open findings of the host with low severity. type: Number - contextPath: RiskSense.Host.Info description: The number of open findings of the host with info severity. type: Number - contextPath: Ticket.ID description: The ID of the ticket associated with the host. type: String - contextPath: Ticket.State description: The state of the ticket associated with the host. type: String description: Gets in-depth details of a single host. This command accepts either hostname or host ID as an argument. - name: risksense-get-unique-cves arguments: - name: hostFindingId required: true description: The unique host finding ID. The host finding ID is either known by RiskSense users or it can be found in the human-readable output or context data(RiskSense.HostFinding.ID) after executing 'risksense-get-host-findings' command. outputs: - contextPath: RiskSense.UniqueVulnerabilities.Cve description: Common Vulnerabilities and Exposures name. type: String - contextPath: RiskSense.UniqueVulnerabilities.HostFindingID description: The unique ID of the host finding. type: String - contextPath: RiskSense.UniqueVulnerabilities.BaseScore description: The base score represents the severity of the risk (informational, low, medium, high, or critical). - contextPath: RiskSense.UniqueVulnerabilities.ThreatCount description: Total number of threats found. type: Number - contextPath: RiskSense.UniqueVulnerabilities.AttackVector description: The attack vectors are a path by which attackers can gain access to the network. type: String - contextPath: RiskSense.UniqueVulnerabilities.AccessComplexity description: The access complexity describes conditions that are beyond the attacker's control that must exist in order to exploit the vulnerability. type: String - contextPath: RiskSense.UniqueVulnerabilities.Authentication description: The authentication value represents attackers authorization to get network access. type: String - contextPath: RiskSense.UniqueVulnerabilities.ConfidentialityImpact description: The confidentiality impact measures the potential impact on confidentiality of a successfully exploited misuse vulnerability. type: String - contextPath: RiskSense.UniqueVulnerabilities.Integrity description: The Integrity refers to the trust level and veracity of the information. type: String - contextPath: RiskSense.UniqueVulnerabilities.AvailabilityImpact description: The availability refers to accessibility of network resources. type: String - contextPath: RiskSense.UniqueVulnerabilities.Trending description: Trending is defined by RiskSense as vulnerabilities that are being actively abused by attackers in the wild based on activity in hacker forums, Twitter feeds, and analysis of 3rd party threat intelligence sources. type: Boolean - contextPath: RiskSense.UniqueVulnerabilities.VulnLastTrendingOn description: The last trending date of vulnerability. type: String - contextPath: CVE.ID description: Common Vulnerabilities and Exposures ID. type: String - contextPath: CVE.Description description: Description about CVE. type: String - contextPath: CVE.CVSS description: The CVSS represents the severity of the risk (informational, low, medium, high, critical). type: String description: Looks up vulnerability details for the supplied host finding with its base score. - name: risksense-get-unique-open-findings arguments: - name: fieldname auto: PREDEFINED predefined: - Title - Severity - Source description: The RiskSense host finding attribute that should be considered for filtering the results. The available choices are 'Title', 'Severity', and 'Source'. Apart from the available choices, one can provide the attributes supported by RiskSense API. Refer to the API /uniqueHostFinding/filter API to get the list of supported attributes. The uid of filter attributes must be provided here. e.g. assessment_labels, asset_tags, cvss3BaseI, etc. If specified, 'value' argument is mandatory. - name: operator auto: PREDEFINED predefined: - EXACT - IN - LIKE - BETWEEN description: The match operator should be applied for filtering the hosts based on 'fieldname' and 'value'. Available options are 'EXACT' - filter records exactly matching the criteria; 'IN' - filter records matching any one of the comma-separated values; 'LIKE' - filter records with the value matching the specified pattern. All the records fieldname value contains the string provided in value; 'BETWEEN' - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. - name: value description: The value of the unique open finding property mentioned in 'fieldname' to be considered for filter criteria. isArray: true - name: exclude auto: PREDEFINED predefined: - 'true' - 'false' description: The exclude flag that determines whether the returned records matches filter criteria or not. By default set to False. - name: page description: The index of the page. The index is a numeric value and starting with 0. defaultValue: 0 - name: size description: The maximum number of records to fetch in one page. defaultValue: 10 - name: sort_by auto: PREDEFINED predefined: - Title - Severity - Source - ID description: The fieldname that should be considered for sorting the returned records. defaultValue: severity - name: sort_direction auto: PREDEFINED predefined: - Ascending - Descending description: The sorting direction to apply to returned records. defaultValue: Ascending outputs: - contextPath: RiskSense.UniqueHostFinding.Title description: The title of the unique host finding. type: String - contextPath: RiskSense.UniqueHostFinding.Severity description: Similar to risk rating, the severity of a vulnerability conveys the potential threat. type: Number - contextPath: RiskSense.UniqueHostFinding.HostCount description: The total number of hosts found in unique host finding. type: Number - contextPath: RiskSense.UniqueHostFinding.Source description: The name of the source associated with the unique host finding. type: String - contextPath: RiskSense.UniqueHostFinding.SourceID description: The unique ID of the source. type: String - contextPath: RiskSense.UniqueHostFinding.Href description: Reference API link of the unique host finding search. type: String description: Finds unique open host findings.The open findings can be searched based on input parameters like fieldname (Severity, Title, Source etc), operator (EXACT, IN, LIKE, BETWEEN), page and size. - name: risksense-get-host-findings description: A detailed host finding view with the severity level. Displays vulnerability information like CVE, Threats associated with current findings and origin of findings. arguments: - name: fieldname auto: PREDEFINED predefined: - Title - IP Address - Host Name description: The RiskSense host finding attribute that should be considered for filtering the results. The available choices are 'Title', 'IP Address', or 'Host Name'. In addition to the available choices, you can provide the attributes supported by RiskSense API. Refer to the API /hostFinding/filter API to get the list of supported attributes. The uid of filter attributes must be provided here. e.g. assessment_labels, asset_tags, cvss3BaseI, etc. If specified, 'value' argument is mandatory. - name: operator auto: PREDEFINED predefined: - EXACT - IN - LIKE - BETWEEN description: The match operator should be applied for filtering the hosts based on 'fieldname' and 'value'. Available options are 'EXACT' (filter records exactly matching the criteria), 'IN' (filter records matching any one of the comma-separated values), or 'LIKE' (filter records with the value matching the specified pattern). All the records fieldname value contains the string provided in value; 'BETWEEN' - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. - name: exclude auto: PREDEFINED predefined: - 'true' - 'false' description: The exclude flag that determines whether the returned records matches filter criteria or not. By default set to False. - name: value description: The value of the 'fieldname' to be considered for filter criteria. isArray: true - name: page description: The index of the page. The index is numeric value starting with 0. defaultValue: 0 - name: size description: The maximum number of records to fetch in one page. defaultValue: 10 - name: sort_by auto: PREDEFINED predefined: - Risk Rating - Severity description: The fieldname that should be considered for sorting the returned records. defaultValue: Risk Rating - name: sort_direction auto: PREDEFINED predefined: - Ascending - Descending description: The sorting direction to apply to returned records. defaultValue: Ascending - name: status auto: PREDEFINED predefined: - Open - Closed description: The status of the host findings to be considered for returned records. outputs: - contextPath: RiskSense.HostFinding.ID description: The unique ID of the host finding. type: String - contextPath: RiskSense.HostFinding.Source description: Host discovered by the scanner. type: String - contextPath: RiskSense.HostFinding.SourceID description: Scanner ID of discovered scanner. type: String - contextPath: RiskSense.HostFinding.Title description: The title of the host finding. type: String - contextPath: RiskSense.HostFinding.Port description: The port number of the host finding. type: Number - contextPath: RiskSense.HostFinding.GroupCount description: The total number of groups for host finding. type: Number - contextPath: RiskSense.HostFinding.GroupID description: The unique ID of the group associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.GroupName description: The name of the group associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Group.ID description: The unique ID of the group associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Group.Name description: The name of the group associated with the host finding. type: String - contextPath: RiskSense.HostFinding.HostID description: The unique ID of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.HostName description: The hostname of the host associated with the host finding. type: String - contextPath: RiskSense.HostFinding.HostIpAddress description: The IP address of the host associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Host.Criticality description: The criticality of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.External description: Whether the identify of the host is external or internal. type: boolean - contextPath: RiskSense.HostFinding.Host.Port.ID description: The unique ID of the host(s) port associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.Port.Number description: The port number of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.Rs3 description: The Asset Security Score calculated by the RiskSense platform (includes vulnerability risk on related web applications). type: Number - contextPath: RiskSense.HostFinding.Network.ID description: The network ID of the host finding. type: Number - contextPath: RiskSense.HostFinding.Network.Name description: The name of the network used by the host finding. type: String - contextPath: RiskSense.HostFinding.Network.Type description: The type of the network used by the host finding. type: String - contextPath: RiskSense.HostFinding.Assessment.ID description: The assessment ID of the host finding. type: Number - contextPath: RiskSense.HostFinding.Assessment.Name description: The name of the assessment associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Assessment.Date description: The time when the assessment is created. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Cve description: The name of the Common Vulnerabilities and Exposures associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Vulnerability.BaseScore description: CVE Score. type: Number - contextPath: RiskSense.HostFinding.Vulnerability.ThreatCount description: The total number of threats associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Vulnerability.AttackVector description: Vector information in which the host was attacked. type: String - contextPath: RiskSense.HostFinding.Vulnerability.AccessComplexity description: Complexity level. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Authentication description: Authentication value represents attackers authorization to get network access. type: String - contextPath: RiskSense.HostFinding.Vulnerability.ConfidentialityImpact description: Confidentiality impact measures the potential impact on confidentiality of a successfully exploited misuse vulnerability. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Integrity description: Integrity refers to the trustworthiness and veracity of information. type: String - contextPath: RiskSense.HostFinding.Vulnerability.AvailabilityImpact description: Availability refers to accessibility of network resources. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Trending description: This signifies whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending. type: boolean - contextPath: RiskSense.HostFinding.Vulnerability.VulnLastTrendingOn description: Date when last trending vulnerability was found. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Description description: A description of the CVE. type: String - contextPath: RiskSense.HostFinding.ThreatCount description: The total number of threats. type: Number - contextPath: RiskSense.HostFinding.Threat.Title description: The title of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Category description: The threat category. type: String - contextPath: RiskSense.HostFinding.Threat.Severity description: The severity level of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Description description: The threat description. type: String - contextPath: RiskSense.HostFinding.Threat.Cve description: The Common Vulnerabilities and Exposures name of the threat. - contextPath: RiskSense.HostFinding.Threat.Source description: The source of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Published description: The time when the threat was published. type: String - contextPath: RiskSense.HostFinding.Threat.Updated description: The time when the threat was last updated. type: String - contextPath: RiskSense.HostFinding.Threat.ThreatLastTrendingOn description: The last time when threat was in trending. type: String - contextPath: RiskSense.HostFinding.Threat.Trending description: Whether the threat is trending. type: boolean - contextPath: RiskSense.HostFinding.Patch.Name description: The patch name of the host finding. type: String - contextPath: RiskSense.HostFinding.Patch.Url description: The patch URL of the host finding. type: String - contextPath: RiskSense.HostFinding.TagCount description: The total number of tags associated with host finding. type: Number - contextPath: RiskSense.HostFinding.Tag.ID description: The tag identifier of the host finding. type: Number - contextPath: RiskSense.HostFinding.Tag.Name description: The tag name of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Category description: The tag category of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Description description: The tag description of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.HostFinding.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.HostFinding.Tag.Color description: The color of the tag. type: String - contextPath: RiskSense.HostFinding.TagAssetCount description: The total number of tag assets. type: Number - contextPath: RiskSense.HostFinding.TagAsset.ID description: The ID of the tag asset. type: Number - contextPath: RiskSense.HostFinding.TagAsset.Name description: The name of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Category description: The category of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Description description: The description of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Created description: The date and time when tag asset was created. type: String - contextPath: RiskSense.HostFinding.TagAsset.Updated description: The time when the tag asset was last updated. type: String - contextPath: RiskSense.HostFinding.TagAsset.Color description: The color name of the tag asset. type: String - contextPath: RiskSense.HostFinding.Output description: The output of the host finding. type: String - contextPath: RiskSense.HostFinding.Severity description: The severity of the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Combined description: The combined name of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Overridden description: The overridden name of the severity detail for the host finding. type: boolean - contextPath: RiskSense.HostFinding.SeverityDetail.Scanner description: The scanner of the severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.CvssV2 description: The CVSS v2 value of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.CvssV3 description: The CVSS v3 value of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Aggregated description: The aggregated value of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.State description: The state of the severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.StateName description: The state name of the severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.ExpirationDate description: The time when the severity detail expired. type: String - contextPath: RiskSense.HostFinding.RiskRating description: The risk rate of the host finding. type: Number - contextPath: RiskSense.HostFinding.Xrs3Impact description: The impact of xrs3 for the host finding. type: String - contextPath: RiskSense.HostFinding.Xrs3ImpactOnCategory description: The category impact of xrs3 for the host finding. type: String - contextPath: RiskSense.HostFinding.LastFoundOn description: The latest time when the particular host finding is found. type: String - contextPath: RiskSense.HostFinding.DiscoveredOn description: The time when the host finding was discovered. type: String - contextPath: RiskSense.HostFinding.ResolvedOn description: The time when the host finding was resolved. type: String - contextPath: RiskSense.HostFinding.ScannerName description: The name of the scanner of the host finding. type: String - contextPath: RiskSense.HostFinding.FindingType description: The finding type of the host finding. type: String - contextPath: RiskSense.HostFinding.MachineID description: The machine ID of the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.State description: The current state of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.StateName description: The state name of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.StateDescription description: The state description of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.Status description: The status of embedded status associated with the host finding. type: boolean - contextPath: RiskSense.HostFinding.StatusEmbedded.DurationInDays description: The time duration (In days) of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.DueDate description: The due date of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.ExpirationDate description: The time when the status is expired associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReportCount description: The total number of manual finding reports associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.ManualFindingReport.ID description: The ID of manual finding reports associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.ManualFindingReport.Title description: The title of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Label description: The label of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Pii description: The PII number of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Source description: The source of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.IsManualExploit description: Whether the manual finding report is an exploit. type: boolean - contextPath: RiskSense.HostFinding.ManualFindingReport.EaseOfExploit description: The total number of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.NoteCount description: Number of notes found for the host finding. type: Number - contextPath: RiskSense.HostFinding.Note.Date description: The time when the note was added by the user for the host finding. type: String - contextPath: RiskSense.HostFinding.Note.Note description: The notes that were added by the user for the host finding. type: String - contextPath: RiskSense.HostFinding.Note.UserID description: The User ID of the user who added the note for the host finding. type: Number - contextPath: RiskSense.HostFinding.Note.UserName description: The username of the user who added a note for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.ID description: The unique ID of the assignment associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Assignment.FirstName description: The first name of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.LastName description: The last name of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.ReceiveEmails description: Indicates whether the email was received. type: boolean - contextPath: RiskSense.HostFinding.Assignment.Email description: The email address of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.Username description: The username of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Services description: The name of the services for the host finding. type: String - contextPath: Ticket.ID description: The ID of the ticket associated with the host finding. type: String - contextPath: Ticket.State description: The state of the ticket associated with the host finding. type: String - contextPath: Host.Hostname description: The hostname of the host. type: String - contextPath: Host.ID description: The unique ID within the tool retrieving the host. type: String - contextPath: Host.IP description: The IP address of the host. type: String - contextPath: CVE.ID description: Common Vulnerabilities and Exposures ID. type: String - contextPath: CVE.Description description: Description of the CVE. type: String - contextPath: CVE.CVSS description: The CVSS represents the severity of the risk (informational, low, medium, high, critical). type: String - contextPath: RiskSense.HostFinding.Ticket.TicketNumber description: The number of tickets associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.TicketStatus description: The status of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.DeepLink description: The deeplink associated with the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.Type description: The type of ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.ConnectorName description: The connector name of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.DetailedStatus description: The detailed status of the ticket associated with the host finding. type: String - name: risksense-get-apps arguments: - name: fieldname auto: PREDEFINED predefined: - Name - Network - Address description: The RiskSense application attribute that should be considered for filtering the results. The available choices are 'Name', 'Network', or 'Address'. Apart from the available choices, one can provide the attributes supported by RiskSense API. Refer to the API /application/filter API to get the list of supported attributes. The uid of filter attributes must be provided here. e.g. assessment_labels, asset_tags, cvss3BaseI, etc. If specified, 'value' argument is mandatory. - name: operator auto: PREDEFINED predefined: - EXACT - IN - LIKE - BETWEEN description: The match operator should be applied for filtering the hosts based on 'fieldname' and 'value'. Available options are 'EXACT' (filter records exactly matching the criteria), 'IN' (filter records matching any one of the comma-separated values), or 'LIKE' (filter records with the value matching the specified pattern). All the records fieldname value contains the string provided in value; 'BETWEEN' - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. - name: value description: The value of the apps property mentioned in 'fieldname' to be considered for filter criteria. - name: exclude auto: PREDEFINED predefined: - 'true' - 'false' description: The exclude flag that determines whether the returned records matches filter criteria or not. The default is "false". - name: page description: The index of the page. The index is a numeric value and starting with 0. defaultValue: 0 - name: size description: The maximum number of records to fetch in one page. defaultValue: 10 - name: sort_by auto: PREDEFINED predefined: - Address - Name - Network - Total Findings - Critical Findings - Info Findings - Low Findings - Medium Findings - High Findings description: The fieldname that should be considered for sorting the returned records. defaultValue: Name - name: sort_direction auto: PREDEFINED predefined: - Ascending - Descending description: The sorting direction to apply to returned records. defaultValue: Ascending outputs: - contextPath: RiskSense.Application.ID description: The unique ID within the tool retrieving the application. type: Number - contextPath: RiskSense.Application.GroupID description: The group ID of the application. type: Number - contextPath: RiskSense.Application.GroupName description: The group name of the application. type: String - contextPath: RiskSense.Application.Group.ID description: The ID of the group belonging to the Application. type: Number - contextPath: RiskSense.Application.Group.Name description: The name of the group belonging to the Application. type: String - contextPath: RiskSense.Application.Network.ID description: The network ID of the application. type: Number - contextPath: RiskSense.Application.Network.Name description: The network name of the application. type: String - contextPath: RiskSense.Application.Network.Type description: The network type of the application. type: String - contextPath: RiskSense.Application.ClientID description: The client ID of the application. type: Number - contextPath: RiskSense.Application.HostID description: The host ID of the application. type: Number - contextPath: RiskSense.Application.Uri description: The reference URI of the application. type: String - contextPath: RiskSense.Application.Name description: The name of the application. type: String - contextPath: RiskSense.Application.Description description: The detailed description of the application. type: String - contextPath: RiskSense.Application.NoteCount description: The total number of notes found in the application. type: Number - contextPath: RiskSense.Application.DiscoveredOn description: The time when the application was discovered. type: String - contextPath: RiskSense.Application.LastFoundOn description: The time when the application was last found. type: String - contextPath: RiskSense.Application.Total description: The total number of open findings of the application. type: Number - contextPath: RiskSense.Application.Critical description: The number of open findings of the application with critical severity. type: Number - contextPath: RiskSense.Application.High description: The number of open findings of the application with high severity. type: Number - contextPath: RiskSense.Application.Medium description: The number of open findings of the application with medium severity. type: Number - contextPath: RiskSense.Application.Low description: The number of open findings of the application with low severity. type: Number - contextPath: RiskSense.Application.Info description: The number of open findings of the application with info severity. type: Number - contextPath: RiskSense.Application.Icon.Type description: The type of icon of the application. type: String - contextPath: RiskSense.Application.Icon.OverlayText description: The overlay text of the icon of the application. type: String - contextPath: RiskSense.Application.TagCount description: The total number of tags of the application. type: Number - contextPath: RiskSense.Application.UrlCount description: The total number of URLs of the application. type: Number - contextPath: RiskSense.Application.Href description: The deeplink pointing to the application details on RiskSense. type: String - contextPath: RiskSense.Application.CMDB.ManufacturedBy description: The name of the manufacturer in the configuration management DB (CMDB) from application details. type: String - contextPath: RiskSense.Application.CMDB.Model description: The CMDB model name of the application. type: String - contextPath: RiskSense.Application.CMDB.MacAddress description: The CMDB MAC address of the application. type: String - contextPath: RiskSense.Application.CMDB.Location description: The CMDB location of the application. type: String - contextPath: RiskSense.Application.CMDB.ManagedBy description: The CMDB entity name that managed the application. type: String - contextPath: RiskSense.Application.CMDB.OwnedBy description: The CMDB entity name that owned the application. type: String - contextPath: RiskSense.Application.CMDB.SupportedBy description: The CMDB entity name that supported the application. type: String - contextPath: RiskSense.Application.CMDB.SupportGroup description: The CMDB supporting group of the application. type: String - contextPath: RiskSense.Application.CMDB.SysID description: The CMDB system ID of the application. type: String - contextPath: RiskSense.Application.CMDB.OperatingSystem description: The CMDB operating system of the application. type: String - contextPath: RiskSense.Application.CMDB.LastScanDate description: The CMDB last scan date of the application. type: String - contextPath: RiskSense.Application.CMDB.FerpaComplianceAsset description: The Family Educational Rights and Privacy Act. type: Boolean - contextPath: RiskSense.Application.CMDB.HipaaComplianceAsset description: Health Insurance Portability and Accountability Act. type: Boolean - contextPath: RiskSense.Application.CMDB.PciComplianceAsset description: The Payment Card Industry (PCI) Council continues to make changes to ensure that their standards are up to date with emerging threats and changes in the market. type: String - contextPath: RiskSense.Application.Ticket.TicketNumber description: The number of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.TicketStatus description: The status of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.Type description: The type of ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.ConnectorName description: The connector name of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.DetailedStatus description: The detailed status of ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.DeepLink description: The deeplink associated with the ticket associated with the application. type: String - contextPath: RiskSense.Application.Source.Name description: The name of the source associated with the application. type: String - contextPath: RiskSense.Application.Source.UuID description: The unique ID of the source associated with the application. type: String - contextPath: RiskSense.Application.Source.ScannerType description: The type of scanner of the source associated with the application.. type: String - contextPath: RiskSense.Application.Note.UserID description: The user ID of the user who added a note for the application. type: String - contextPath: RiskSense.Application.Note.UserName description: The username of the user who added a note for the application. type: String - contextPath: RiskSense.Application.Note.Note description: The notes that were added by the user for the application. type: String - contextPath: RiskSense.Application.Note.Date description: The time when the note was added by the user for the application. type: String - contextPath: RiskSense.Application.Tag.ID description: The ID of the tag. type: Number - contextPath: RiskSense.Application.Tag.Name description: The name of the tag. type: String - contextPath: RiskSense.Application.Tag.Category description: The category of the tag. type: String - contextPath: RiskSense.Application.Tag.Description description: The description of the tag. type: String - contextPath: RiskSense.Application.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.Application.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.Application.Tag.Color description: The color code of the tag of the application. type: String - contextPath: Ticket.ID description: The ID of the ticket associated with the application. type: String - contextPath: Ticket.State description: The state of the ticket associated with the application. type: String description: Looks up the application details. The application details can be searched based on input parameters like fieldname (Name, Network, Address), operator (EXACT, IN, LIKE, BETWEEN), page, size, sort by and sort direction. - name: risksense-get-host-finding-detail description: Gets in-depth details of a single host finding. The command accepts the host finding ID as an argument. arguments: - name: hostfinding_id description: The unique host finding ID. The host finding ID is either known by RiskSense users or it can be found in the human-readable output or context data(RiskSense.HostFinding.ID) after executing 'risksense-get-host-findings' command. required: true outputs: - contextPath: RiskSense.HostFinding.ID description: The unique ID of the host finding. type: String - contextPath: RiskSense.HostFinding.Source description: Host discovered by the scanner. type: String - contextPath: RiskSense.HostFinding.SourceID description: Scanner ID of the discovered scanner. type: String - contextPath: RiskSense.HostFinding.Title description: The title of the host finding. type: String - contextPath: RiskSense.HostFinding.Port description: The port number of the host finding. type: Number - contextPath: RiskSense.HostFinding.GroupCount description: The total number of groups for the host finding. type: Number - contextPath: RiskSense.HostFinding.GroupID description: The unique ID of the group associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.GroupName description: The name of the group associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Group.ID description: The unique ID of the group associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Group.Name description: The name of the group associated with the host finding. type: String - contextPath: RiskSense.HostFinding.HostID description: The unique ID of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.HostName description: The hostname of the host associated with the host finding. type: String - contextPath: RiskSense.HostFinding.HostIpAddress description: The IP address of the host associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Host.Criticality description: The criticality of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.External description: Whether the host is external. type: boolean - contextPath: RiskSense.HostFinding.Host.Port.ID description: The unique ID of the host(s) port associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.Port.Number description: The port number of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.Rs3 description: The Asset Security Score calculated by the RiskSense platform (includes vulnerability risk on related web applications). type: Number - contextPath: RiskSense.HostFinding.Network.ID description: The network ID of the host finding. type: Number - contextPath: RiskSense.HostFinding.Network.Name description: The name of the network used by the host finding. type: String - contextPath: RiskSense.HostFinding.Network.Type description: The type of the network used by the host finding. type: String - contextPath: RiskSense.HostFinding.Assessment.ID description: The assessment ID of the host finding. type: Number - contextPath: RiskSense.HostFinding.Assessment.Name description: The name of the assessment associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Assessment.Date description: The time when the assessment is created. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Cve description: The name of the Common Vulnerabilities and Exposures associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Vulnerability.BaseScore description: CVE Score. type: Number - contextPath: RiskSense.HostFinding.Vulnerability.ThreatCount description: The total number of threats associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Vulnerability.AttackVector description: Vector information in which the host finding was attacked. type: String - contextPath: RiskSense.HostFinding.Vulnerability.AccessComplexity description: Complexity level. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Authentication description: Authentication value represents attackers authorization to get network access. type: String - contextPath: RiskSense.HostFinding.Vulnerability.ConfidentialityImpact description: Confidentiality impact measures the potential impact on the confidentiality of a successfully exploited misuse vulnerability. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Integrity description: Integrity refers to the level of trust and veracity of the information. type: String - contextPath: RiskSense.HostFinding.Vulnerability.AvailabilityImpact description: Availability refers to accessibility of network resources. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Trending description: Whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending. type: boolean - contextPath: RiskSense.HostFinding.Vulnerability.VulnLastTrendingOn description: Date when the last trending vulnerability was found. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Description description: A description of the CVE. type: String - contextPath: RiskSense.HostFinding.ThreatCount description: The total number of threats. type: Number - contextPath: RiskSense.HostFinding.Threat.Title description: The title of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Category description: The category of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Severity description: The severity level of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Description description: The threat description. type: String - contextPath: RiskSense.HostFinding.Threat.Cve description: The Common Vulnerabilities and Exposures name of the threat. - contextPath: RiskSense.HostFinding.Threat.Source description: The source of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Published description: The time when threat was published. type: String - contextPath: RiskSense.HostFinding.Threat.Updated description: The time when the threat was last updated. type: String - contextPath: RiskSense.HostFinding.Threat.ThreatLastTrendingOn description: The last time when the threat was trending. type: String - contextPath: RiskSense.HostFinding.Threat.Trending description: Whether the threat is trending. type: boolean - contextPath: RiskSense.HostFinding.Patch.Name description: The patch name of the host finding. type: String - contextPath: RiskSense.HostFinding.Patch.Url description: The patch URL of the host finding. type: String - contextPath: RiskSense.HostFinding.TagCount description: The total number of tags associated with host finding. type: Number - contextPath: RiskSense.HostFinding.Tag.ID description: The tag identifier of the host finding. type: Number - contextPath: RiskSense.HostFinding.Tag.Name description: The tag name of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Category description: The tag category of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Description description: The tag description of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.HostFinding.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.HostFinding.Tag.Color description: The color of the tag. type: String - contextPath: RiskSense.HostFinding.TagAssetCount description: The total number of tag assets. type: Number - contextPath: RiskSense.HostFinding.TagAsset.ID description: The ID of the tag asset. type: Number - contextPath: RiskSense.HostFinding.TagAsset.Name description: The name of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Category description: The category of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Description description: The description of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Created description: The time and date when the tag asset was created. type: String - contextPath: RiskSense.HostFinding.TagAsset.Updated description: The time when the tag asset was last updated. type: String - contextPath: RiskSense.HostFinding.TagAsset.Color description: The color name of the tag asset. type: String - contextPath: RiskSense.HostFinding.Output description: The output of the host finding. type: String - contextPath: RiskSense.HostFinding.Severity description: The severity of the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Combined description: The combined name of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Overridden description: The overridden name of the severity detail for the host finding. type: boolean - contextPath: RiskSense.HostFinding.SeverityDetail.Scanner description: The scanner of severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.CvssV2 description: The CVSS v2 value of severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.CvssV3 description: The CVSS v3 value of severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Aggregated description: The aggregated value of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.State description: The state of the severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.StateName description: The state name of the severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.ExpirationDate description: The time when the severity detail expired. type: String - contextPath: RiskSense.HostFinding.RiskRating description: The risk rate of the host finding. type: Number - contextPath: RiskSense.HostFinding.Xrs3Impact description: The impact of xrs3 for the host finding. type: String - contextPath: RiskSense.HostFinding.Xrs3ImpactOnCategory description: The category impact of xrs3 for the host finding. type: String - contextPath: RiskSense.HostFinding.LastFoundOn description: The latest time when the particular host finding was found. type: String - contextPath: RiskSense.HostFinding.DiscoveredOn description: The time when the host finding was discovered. type: String - contextPath: RiskSense.HostFinding.ResolvedOn description: The time when the host finding was resolved. type: String - contextPath: RiskSense.HostFinding.ScannerName description: The name of the scanner of the host finding. type: String - contextPath: RiskSense.HostFinding.FindingType description: The finding type of the host finding. type: String - contextPath: RiskSense.HostFinding.MachineID description: The machine ID of the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.State description: The current state of the embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.StateName description: The state name of the embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.StateDescription description: The state description of the embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.Status description: The status of the embedded status associated with the host finding. type: boolean - contextPath: RiskSense.HostFinding.StatusEmbedded.DurationInDays description: The time duration (in days) of the embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.DueDate description: The due date of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.ExpirationDate description: The time when status is expired associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReportCount description: The total number of manual finding reports associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.ManualFindingReport.ID description: The ID of manual finding reports associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.ManualFindingReport.Title description: The title of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Label description: The label of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Pii description: The pii number of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Source description: The source of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.IsManualExploit description: To check whether manual finding report is exploit or not. type: boolean - contextPath: RiskSense.HostFinding.ManualFindingReport.EaseOfExploit description: The total number of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.NoteCount description: Number of notes found. type: Number - contextPath: RiskSense.HostFinding.Note.Date description: The time when the note was added by the user for the host finding. type: String - contextPath: RiskSense.HostFinding.Note.Note description: The notes that are added by the user for the host finding. type: String - contextPath: RiskSense.HostFinding.Note.UserID description: The User ID of the user who added a note for the host finding. type: Number - contextPath: RiskSense.HostFinding.Note.UserName description: The username of the user who added a note for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.ID description: The unique ID of the assignment associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Assignment.FirstName description: The first name of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.LastName description: The last name of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.ReceiveEmails description: Indicates whether email is received or not. type: boolean - contextPath: RiskSense.HostFinding.Assignment.Email description: The email of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.Username description: The username of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Services description: The name of the services for the host finding. type: String - contextPath: Ticket.ID description: The ID of the ticket associated with the host finding. type: String - contextPath: Ticket.State description: The state of the ticket associated with the host finding. type: String - contextPath: Host.Hostname description: The hostname of the host. type: String - contextPath: Host.ID description: The unique ID within the tool retrieving the host. type: String - contextPath: Host.IP description: The IP address of the host. type: String - contextPath: CVE.ID description: Common Vulnerabilities and Exposures ID. type: String - contextPath: CVE.Description description: Description about the CVE. type: String - contextPath: CVE.CVSS description: The CVSS represents the severity of the risk (informational, low, medium, high, critical). type: String - contextPath: RiskSense.HostFinding.Ticket.TicketNumber description: The number of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.TicketStatus description: The status of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.DeepLink description: The deeplink associated with the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.Type description: The type of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.ConnectorName description: The connector name of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.DetailedStatus description: The detailed status of the ticket associated with the host finding. type: String - name: risksense-get-app-detail arguments: - name: application_id required: true description: The application ID is unique for the application. The application ID is either known by RiskSense users or it can be searched in context output (RiskSense.Application.ID) or in the human-readable output of 'risksense-get-apps' command. outputs: - contextPath: RiskSense.Application.ID description: The unique ID within the tool retrieving the application. type: Number - contextPath: RiskSense.Application.GroupID description: The group ID of the application. type: Number - contextPath: RiskSense.Application.GroupName description: The group name of the application. type: String - contextPath: RiskSense.Application.Group.ID description: The ID of the group belonging to the Application. type: Number - contextPath: RiskSense.Application.Group.Name description: The name of the group belonging to the Application. type: String - contextPath: RiskSense.Application.Network.ID description: The network ID of the application. type: Number - contextPath: RiskSense.Application.Network.Name description: The network name of the application. type: String - contextPath: RiskSense.Application.Network.Type description: The network type of the application. type: String - contextPath: RiskSense.Application.ClientID description: The client ID of the application. type: Number - contextPath: RiskSense.Application.HostID description: The host ID of the application. type: Number - contextPath: RiskSense.Application.Uri description: The reference URI of the application. type: String - contextPath: RiskSense.Application.Name description: The name of the application. type: String - contextPath: RiskSense.Application.Description description: The detailed description of the application. type: String - contextPath: RiskSense.Application.NoteCount description: The total number of notes found in the application. type: Number - contextPath: RiskSense.Application.DiscoveredOn description: The time when the application was discovered. type: String - contextPath: RiskSense.Application.LastFoundOn description: The time when the application was last found. type: String - contextPath: RiskSense.Application.Total description: The total number of open findings of the application. type: Number - contextPath: RiskSense.Application.Critical description: The number of open findings of the application with critical severity. type: Number - contextPath: RiskSense.Application.High description: The number of open findings of the application with high severity. type: Number - contextPath: RiskSense.Application.Medium description: The number of open findings of the application with medium severity. type: Number - contextPath: RiskSense.Application.Low description: The number of open findings of the application with low severity. type: Number - contextPath: RiskSense.Application.Info description: The number of open findings of the application with info severity. type: Number - contextPath: RiskSense.Application.Icon.Type description: The icon type of the application. type: String - contextPath: RiskSense.Application.Icon.OverlayText description: The overlay text of the icon of the application. type: String - contextPath: RiskSense.Application.TagCount description: The total number of tags of the application. type: Number - contextPath: RiskSense.Application.UrlCount description: The total number of URLs of the application. type: Number - contextPath: RiskSense.Application.Href description: The deeplink pointing to the application details on RiskSense. type: String - contextPath: RiskSense.Application.CMDB.ManufacturedBy description: The name of the manufacturer in configuration management DB (CMDB) from application details. type: String - contextPath: RiskSense.Application.CMDB.Model description: The CMDB model name of the application. type: String - contextPath: RiskSense.Application.CMDB.MacAddress description: The CMDB MAC Address of the application. type: String - contextPath: RiskSense.Application.CMDB.Location description: The CMDB location of the application. type: String - contextPath: RiskSense.Application.CMDB.ManagedBy description: The CMDB entity name that managed the application. type: String - contextPath: RiskSense.Application.CMDB.OwnedBy description: The CMDB entity name that owned the application. type: String - contextPath: RiskSense.Application.CMDB.SupportedBy description: The CMDB entity name that supported the application. type: String - contextPath: RiskSense.Application.CMDB.SupportGroup description: The CMDB supporting group of the application. type: String - contextPath: RiskSense.Application.CMDB.SysID description: The CMDB system ID of the application. type: String - contextPath: RiskSense.Application.CMDB.OperatingSystem description: The CMDB Operating system of the application. type: String - contextPath: RiskSense.Application.CMDB.LastScanDate description: The CMDB last scan date of the application. type: String - contextPath: RiskSense.Application.CMDB.FerpaComplianceAsset description: The Family Educational Rights and Privacy Act. type: Boolean - contextPath: RiskSense.Application.CMDB.HipaaComplianceAsset description: Health Insurance Portability and Accountability Act. type: Boolean - contextPath: RiskSense.Application.CMDB.PciComplianceAsset description: The Payment Card Industry (PCI) Council continues to make changes to ensure that their standards are up to date with emerging threats and changes in the market. type: String - contextPath: RiskSense.Application.Ticket.TicketNumber description: The number of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.TicketStatus description: The status of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.Type description: The type of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.ConnectorName description: The connector name of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.DetailedStatus description: The detailed status of ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.DeepLink description: The deeplink associated with the ticket associated with the application. type: String - contextPath: RiskSense.Application.Source.Name description: The name of the source associated with the application. type: String - contextPath: RiskSense.Application.Source.UuID description: The unique ID of the source associated with the application. type: String - contextPath: RiskSense.Application.Source.ScannerType description: The type of scanner of the source associated with the application.. type: String - contextPath: RiskSense.Application.Note.UserID description: The user ID of the user who added a note for the application. type: String - contextPath: RiskSense.Application.Note.UserName description: The username of the user who added a note for the application. type: String - contextPath: RiskSense.Application.Note.Note description: The notes that are added by the user for the application. type: String - contextPath: RiskSense.Application.Note.Date description: The time when the note was added by the user for the application. type: String - contextPath: RiskSense.Application.Tag.ID description: The ID of the tag. type: Number - contextPath: RiskSense.Application.Tag.Name description: The name of the tag. type: String - contextPath: RiskSense.Application.Tag.Category description: The category of the tag. type: String - contextPath: RiskSense.Application.Tag.Description description: The description of the tag. type: String - contextPath: RiskSense.Application.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.Application.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.Application.Tag.Color description: The color code of the tag of the application. type: String - contextPath: Ticket.ID description: The ID of the ticket associated with the application. type: String - contextPath: Ticket.State description: The state of the ticket associated with the application. type: String description: Gets in-depth details of a single application. The command accepts an application ID as an argument. - name: risksense-apply-tag arguments: - name: propagate_to_all_findings defaultValue: 'false' auto: PREDEFINED predefined: - 'true' - 'false' description: If the given argument is set to true, then it applies the tag to assets as well as findings of assets. Note - It only works if the tag with the given name does not exist. - name: assettype required: true description: Type of asset available in RiskSense to apply the tag. Apart from the available choices, you can provide the asset type supported by RiskSense API. auto: PREDEFINED predefined: - host - hostFinding - application - applicationFinding - name: tagname required: true description: Tag name which applies to the asset(s). - name: fieldname description: The RiskSense asset attribute by which to filter the assets to apply the tag. It can be an attribute of Host, Application, Host Finding, Application Finding. If specified, the 'value' argument is mandatory. - name: operator auto: PREDEFINED predefined: - EXACT - IN - LIKE - BETWEEN description: The match operator should be applied for filtering the assets to apply the tag based on 'fieldname' and 'value'. Can be 'EXACT' - filter records exactly matching the criteria; 'IN' - filter records matching any one of the comma-separated values; 'LIKE' - filter records with the value matching the specified pattern. All the records fieldname value contains the string provided in value; 'BETWEEN' - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. - name: exclude auto: PREDEFINED predefined: - 'true' - 'false' description: The exclude flag that determines whether to apply the tag on assets matches filter criteria or not. Default set to false. If set to true, tag applied on an asset not matching the specified values. - name: value description: The value of the asset property mentioned in 'fieldname' to be considered for filter criteria. isArray: true outputs: - contextPath: RiskSense.TagAssociation.TagName description: Name of the tag. type: String - contextPath: RiskSense.TagAssociation.AssociationID description: Tag association ID. type: Number - contextPath: RiskSense.TagAssociation.Created description: The time when the tag was associated. type: String description: Apply the new or existing tag to the asset, creates a new tag if it does not exist in RiskSense. dockerimage: demisto/python3:3.12.13.10116658 runonce: false subtype: python3 type: python fromversion: 5.0.0 tests: - RiskSense Get Apps - Test - RiskSense Get Host Detail - Test - RiskSense Get Host Finding Detail - Test - RiskSense Get Hosts - Test - RiskSense Get Host Findings - Test - RiskSense Get Unique Cves - Test - RiskSense Get Unique Open Findings - Test - RiskSense Get Apps Detail - Test - RiskSense Apply Tag - Test