Check Point - Vulnerability Exploitation Monitoring

Enriches CVEs from a vulnerability-management incident with Cyberint vulnerability intelligence and prioritizes them based on real-world exploitation. For each CVE the playbook retrieves the Cyberint CVE score, CVSS, EPSS, CWE and active-exploitation evidence. When a CVE exceeds the configured risk thresholds or is being actively exploited, the incident is escalated and a patch-remediation ticket is opened; otherwise the CVE is tagged as monitored. Connect the remediation task to your ticketing system and CMDB to fully automate risk-based vulnerability management.

Pack

Cyberint

Tasks

12

Inputs

• CVE — CVE identifiers to monitor. Expected format: ``CVE-YYYY-NNNNN`` (case-insensitive). Accepts a comma-separated list, e.g. ``CVE-2024-12345,CVE-2023-44487``. Defaults to CVE indicators extracted from the incident.
• CyberintScoreThreshold — Cyberint CVE score (0-10) at or above which the incident is escalated. Accepts a single number, e.g. ``7`` or ``8.5``. Default is 7.
• CVSSThreshold — CVSS base score (0-10) at or above which the incident is escalated. Accepts a single number, e.g. ``7`` or ``9.8``. Default is 7.
• EPSSThreshold — EPSS probability score (0-1) at or above which the incident is escalated. Accepts a single number between 0 and 1, e.g. ``0.5`` or ``0.97``. Default is 0.5.

Outputs

• Cyberint.CVE — The Cyberint CVE intelligence results, including the Cyberint score, CVSS, EPSS, CWE and active-exploitation evidence.
• CVE — The CVE indicator objects produced by the enrichment.
• Ticket.ID — The identifier of the patch-remediation ticket created for the affected asset. Populated by the customer's ticketing-system integration wired into the "Open patch remediation ticket and update CMDB" task (for example jira-create-issue, servicenow-create-ticket).

Commands used

• cyberint-cve-enrich
• setIncident