CVE Enrichment - Generic v2

This playbook performs CVE Enrichment using the following integrations: - VulnDB - CVE Search - IBM X-Force Exchange

Common Playbooks · 13 tasks · 1 input · 17 outputs

Details

IDCVE Enrichment - Generic v2
From Version5.0.0
Tasks13

README

This playbook performs CVE enrichment using the following integrations:

  • VulnDB
  • CVE Search
  • IBM X-Force Exchange

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • VulnDB
  • CVE Search

Scripts

This playbook does not use any scripts.

Commands

  • cve-search
  • vulndb-get-vuln-by-cve-id
  • cve

Playbook Inputs

Name Description Default Value Required
cve_id The CVE ID to enrich. CVE.ID Optional

Playbook Outputs

Path Description Type
CVE The CVE object. unknown
CVE.ID The ID of the CVE. string
CVE.CVSS The CVSS score of the CVE. number
CVE.Published The date this was published. date
CVE.Modified When the CVE was last modified. date
CVE.Description The CVE description string
VulnDB.Vulnerability.ID Vulnerability ID. unknown
VulnDB.Vulnerability.Title Vulnerability title (human readable). unknown
VulnDB.Vulnerability.Description Vulnerability description (human readable). unknown
VulnDB.Vulnerability.Solution Vulnerability solution (human readable). unknown
VulnDB.CvssMetrics.Id CVSS reference value. unknown
VulnDB.CvssMetrics.ConfidentialityImpact CVSS confidentiality impact. unknown
VulnDB.CvssMetrics.AvailabilityImpact CVSS availability impact. unknown
VulnDB.CvssMetrics.Score CVSS score. unknown
VulnDB.cvssMetrics.integrity_impact CVSS integrity impact. unknown
VulnDB.Vendors.Id Vendor ID. unknown
VulnDB.Products.Id Product IDs. unknown

Playbook Image

CVE Enrichment - Generic v2

Inputs

  • cve_id — The CVE ID to enrich.

Outputs

  • CVE — The CVE object
  • CVE.ID — The ID of the CVE
  • CVE.CVSS — The CVSS score of the CVE
  • CVE.Published — The date this was published
  • CVE.Modified — When CVE was last modified
  • CVE.Description — The CVE description
  • VulnDB.Vulnerability.ID — Vulnerability ID.
  • VulnDB.Vulnerability.Title — Vulnerability title (human readable).
  • VulnDB.Vulnerability.Description — Vulnerability description (human readable).
  • VulnDB.Vulnerability.Solution — Vulnerability solution (human readable).
  • VulnDB.CvssMetrics.Id — CVSS reference value.
  • VulnDB.CvssMetrics.ConfidentialityImpact — CVSS confidentiality impact.
  • VulnDB.CvssMetrics.AvailabilityImpact — CVSS availability impact.
  • VulnDB.CvssMetrics.Score — CVSS score.
  • VulnDB.cvssMetrics.integrity_impact — CVSS integrity impact.
  • VulnDB.Vendors.Id — Vendor ID.
  • VulnDB.Products.Id — Product IDs.

Commands used

cve cve-search vulndb-get-vuln-by-cve-id

Flowchart

yes yes yes yes Start Start Is there a CVE to enrich? Is there a CVE to enrich? Done Done Is IBM X-Force Exchange integration enabled? Is IBM X-Force Exchange i... Is "CVE Search" integration enabled? Is "CVE Search" integrati... Get CVE info from "CVE Search" - cve Get CVE info from "CVE Se... cve Get CVE information from XFE - cve-search Get CVE information from XFE cve-search CVE enrichment CVE enrichment VulnDB - Get vulnerability details by CVE - vulndb-get-vuln-by-cve-id VulnDB - Get vulnerabilit... vulndb-get-vuln-by-cve-id VulnDB VulnDB CVE Search CVE Search IBM X-Force Exchange IBM X-Force Exchange Is VulnDB integration enabled? Is VulnDB integration ena...

Source

playbook-CVE_Enrichment_-_Generic_v2.yml
Download History Raw 
id: CVE Enrichment - Generic v2
version: -1
fromversion: 5.0.0
name: CVE Enrichment - Generic v2
description: |-
  This playbook performs CVE Enrichment using the following integrations:
  - VulnDB
  - CVE Search
  - IBM X-Force Exchange
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 8a9b5f57-93dc-4f6e-847a-472c93c1af17
    type: start
    task:
      id: 8a9b5f57-93dc-4f6e-847a-472c93c1af17
      version: -1
      name: ''
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 4cfa2898-da16-4d61-839a-cc66e5492541
    type: condition
    task:
      id: 4cfa2898-da16-4d61-839a-cc66e5492541
      version: -1
      name: Is there a CVE to enrich?
      description: Verify that the playbook input includes at least one CVE ID to enrich.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '2'
      'yes':
      - '11'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.cve_id
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '2':
    id: '2'
    taskid: 1c1df4a5-6a12-4724-8cf5-586f7743fc57
    type: title
    task:
      id: 1c1df4a5-6a12-4724-8cf5-586f7743fc57
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ''
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '4':
    id: '4'
    taskid: 842e273c-40ee-46c1-837d-f7e09bcefef0
    type: condition
    task:
      id: 842e273c-40ee-46c1-837d-f7e09bcefef0
      version: -1
      name: Is IBM X-Force Exchange integration enabled?
      description: Verify that there's a valid instance of XFE enabled.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '2'
      'yes':
      - '7'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: XFE
                    ignorecase: true
                  - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: XFE_v2
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1530,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 8f3572d2-dbfc-4c4b-82af-94d06b99e727
    type: condition
    task:
      id: 8f3572d2-dbfc-4c4b-82af-94d06b99e727
      version: -1
      name: Is "CVE Search" integration enabled?
      description: Verify that there's a valid instance of "CVE Search" enabled.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '2'
      'yes':
      - '6'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsGeneral
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: CVE Search
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 970,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: c08adb3a-b8c3-4a9b-8290-2f6dcda45d88
    type: regular
    task:
      id: c08adb3a-b8c3-4a9b-8290-2f6dcda45d88
      version: -1
      name: Get CVE info from "CVE Search"
      description: Returns CVE information by CVE ID.
      script: '|||cve'
      type: regular
      iscommand: true
      brand: CVE Search
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      cve_id:
        complex:
          root: inputs.cve_id
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1160,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '7':
    id: '7'
    taskid: d2ff276a-dd81-4805-80c3-ee44976b4020
    type: regular
    task:
      id: d2ff276a-dd81-4805-80c3-ee44976b4020
      version: -1
      name: Get CVE information from XFE
      description: Search for details about the given CVE.
      script: '|||cve-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      cve_id:
        complex:
          root: inputs.cve_id
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1720,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 81a2e52a-0a2a-4791-8a55-e4249923b7b3
    type: title
    task:
      id: 81a2e52a-0a2a-4791-8a55-e4249923b7b3
      version: -1
      name: CVE enrichment
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '13'
      - '14'
      - '26'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: bee9dcb2-a07f-4362-8e17-df1458d42051
    type: regular
    task:
      id: bee9dcb2-a07f-4362-8e17-df1458d42051
      version: -1
      name: VulnDB - Get vulnerability details by CVE
      description: Returns full details about vulnerabilities, by CVE ID.
      script: VulnDB|||vulndb-get-vuln-by-cve-id
      type: regular
      iscommand: true
      brand: VulnDB
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      cve_id:
        complex:
          root: inputs.cve_id
      max_size: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 590,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '13':
    id: '13'
    taskid: 2c6008cc-e42b-4976-86c8-92123558d6b6
    type: title
    task:
      id: 2c6008cc-e42b-4976-86c8-92123558d6b6
      version: -1
      name: VulnDB
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '27'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 400,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '14':
    id: '14'
    taskid: da54676a-2737-437d-8f74-cf90095e20b0
    type: title
    task:
      id: da54676a-2737-437d-8f74-cf90095e20b0
      version: -1
      name: CVE Search
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 970,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '26':
    id: '26'
    taskid: 85a2fa30-ef67-4272-8867-18116129def3
    type: title
    task:
      id: 85a2fa30-ef67-4272-8867-18116129def3
      version: -1
      name: IBM X-Force Exchange
      type: title
      iscommand: false
      brand: ''
      description: ''
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1530,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  '27':
    id: '27'
    taskid: 3b7877c8-6321-4a1c-8444-d2bd91aae191
    type: condition
    task:
      id: 3b7877c8-6321-4a1c-8444-d2bd91aae191
      version: -1
      name: Is VulnDB integration enabled?
      description: Verify that there's a valid instance of XFE enabled.
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '2'
      'yes':
      - '12'
    separatecontext: false
    conditions:
    - label: 'yes'
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: VulnDB
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 400,
          "y": 790
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "1_11_yes": 0.52,
      "1_2_#default#": 0.25,
      "27_2_#default#": 0.39,
      "4_2_#default#": 0.1,
      "4_7_yes": 0.46,
      "5_2_#default#": 0.15
    },
    "paper": {
      "dimensions": {
        "height": 995,
        "width": 1937.5,
        "x": 162.5,
        "y": 200
      }
    }
  }
inputs:
- key: cve_id
  value:
    complex:
      root: CVE
      accessor: ID
  required: false
  description: The CVE ID to enrich.
outputs:
- contextPath: CVE
  description: The CVE object
  type: unknown
- contextPath: CVE.ID
  description: The ID of the CVE
  type: string
- contextPath: CVE.CVSS
  description: The CVSS score of the CVE
  type: number
- contextPath: CVE.Published
  description: The date this was published
  type: date
- contextPath: CVE.Modified
  description: When CVE was last modified
  type: date
- contextPath: CVE.Description
  description: The CVE description
  type: string
- contextPath: VulnDB.Vulnerability.ID
  description: Vulnerability ID.
- contextPath: VulnDB.Vulnerability.Title
  description: Vulnerability title (human readable).
- contextPath: VulnDB.Vulnerability.Description
  description: Vulnerability description (human readable).
- contextPath: VulnDB.Vulnerability.Solution
  description: Vulnerability solution (human readable).
- contextPath: VulnDB.CvssMetrics.Id
  description: CVSS reference value.
- contextPath: VulnDB.CvssMetrics.ConfidentialityImpact
  description: CVSS confidentiality impact.
- contextPath: VulnDB.CvssMetrics.AvailabilityImpact
  description: CVSS availability impact.
- contextPath: VulnDB.CvssMetrics.Score
  description: CVSS score.
- contextPath: VulnDB.cvssMetrics.integrity_impact
  description: CVSS integrity impact.
- contextPath: VulnDB.Vendors.Id
  description: Vendor ID.
- contextPath: VulnDB.Products.Id
  description: Product IDs.
sourceplaybookid: cve_enrichment_-_generic
tests:
- No test
marketplaces:
- xsoar
- marketplacev2
- platform