CVE Exposure - RiskSense

Block IPs and apply the tag to assets that are vulnerable to the specified CVE.

RiskSense · 12 tasks · 2 inputs · 3 outputs

Details

IDCVE Exposure - RiskSense
From Version5.0.0
Tasks12

README

Block IPs and apply the tag to assets that are vulnerable to specified CVE.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Block IP - Generic v2

Integrations

  • RiskSense

Scripts

  • IsIntegrationAvailable

Commands

  • risksense-apply-tag
  • risksense-get-hosts
  • risksense-get-host-findings

Playbook Inputs

Name Description Default Value Required
CVES Specify Common Vulnerabilities and Exposures (CVE). You can mention multiple CVEs using a comma-separated list.   Required
TagName Tags in RiskSense can be applied to assets, web applications, and vulnerabilities. Tags are useful in the soft grouping, workflow creation, and to identify compliance-related assets.   Required

Playbook Outputs

Path Description Type
RiskSense.TagAssociation Tag association details including tag name, association ID, created. unknown
RiskSense.HostFinding List of the host finding details. unknown
RiskSense.Host List of the host details. unknown

Playbook Image

CVE Exposure - RiskSense

Inputs

  • CVES — Specify Common Vulnerabilities and Exposures (CVE). You can mention multiple CVEs using a comma-separated list.
  • TagName — Tags in RiskSense can be applied to assets, web applications, and vulnerabilities. Tags are useful in the soft grouping, workflow creation and to identify compliance-related assets.

Outputs

  • RiskSense.TagAssociation — Tag association details including tag name, association ID, created.
  • RiskSense.HostFinding — List of the host finding details.
  • RiskSense.Host — List of the host details.

Commands used

risksense-apply-tag risksense-get-host-findings risksense-get-hosts

Flowchart

yes yes yes yes yes Start Start Is RiskSense enabled? - IsIntegrationAvailable Is RiskSense enabled? IsIntegrationAvailable Apply tag to found assets - risksense-apply-tag Apply tag to found assets risksense-apply-tag Done Done Get open findings related to CVEs - risksense-get-host-findings Get open findings related... risksense-get-host-findings Are asset findings found? Are asset findings found? Get assets findings with the asset and perform actions Get assets findings with ... Blocks IP addresses (requires at least one integration) Blocks IP addresses (requ... Get asset information with owner - risksense-get-hosts Get asset information wit... risksense-get-hosts Apply tag to found asset findings - risksense-apply-tag Apply tag to found asset ... risksense-apply-tag Block IP - Generic v2 - Block IP - Generic v2 Block IP - Generic v2 Block IP - Generic v2 Are Inputs provided? Are Inputs provided?

Source

playbook-CVE_Exposure_-_RiskSense.yml
Download History Raw 
id: CVE Exposure - RiskSense
version: -1
name: CVE Exposure - RiskSense
description: Block IPs and apply the tag to assets that are vulnerable to the specified CVE.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 0c2f9026-080c-4894-8d97-98e4d8756703
    type: start
    task:
      id: 0c2f9026-080c-4894-8d97-98e4d8756703
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: 'start'
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 130,
          "y": 40
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 5c12e6b5-bebc-4667-845d-eeb7d826155a
    type: condition
    task:
      id: 5c12e6b5-bebc-4667-845d-eeb7d826155a
      version: -1
      name: Is RiskSense enabled?
      description: Returns 'yes' if RiskSense is enabled. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "13"
    scriptarguments:
      brandname:
        simple: RiskSense
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 140,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: e1a7f22d-c964-4537-80f8-c71c9ee58cd1
    type: regular
    task:
      id: e1a7f22d-c964-4537-80f8-c71c9ee58cd1
      version: -1
      name: Apply tag to found assets
      description: Apply the new or existing tag to the asset, or creates a new tag if the tag does not exist in RiskSense.
      script: '|||risksense-apply-tag'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      assettype:
        simple: host
      exclude: {}
      fieldname:
        simple: id
      operator:
        simple: IN
      propagate_to_all_findings: {}
      tagname:
        complex:
          root: inputs.TagName
      value:
        complex:
          root: RiskSense
          accessor: HostFinding.HostID
          transformers:
          - operator: uniq
          - operator: Stringify
          - operator: join
            args:
              separator:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 490,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 7c77c3b8-f938-4e1d-81d7-9c04db2847fb
    type: title
    task:
      id: 7c77c3b8-f938-4e1d-81d7-9c04db2847fb
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: 'Done'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -220,
          "y": 1510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 16aa966e-1fd7-45c8-8d54-1107fd958cdf
    type: regular
    task:
      id: 16aa966e-1fd7-45c8-8d54-1107fd958cdf
      version: -1
      name: Get open findings related to CVEs
      description: A detailed host finding view with the severity level. Displays vulnerability information like CVE, threats associated with current findings, and origin of findings.
      script: '|||risksense-get-host-findings'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      exclude: {}
      fieldname:
        simple: cves
      operator:
        simple: IN
      page: {}
      size:
        simple: "1000"
      sort_by:
        simple: Risk Rating
      sort_direction:
        simple: Descending
      status:
        simple: Open
      value:
        complex:
          root: inputs.CVES
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 4f42421d-9238-4871-8d95-48ef34cc08ae
    type: condition
    task:
      id: 4f42421d-9238-4871-8d95-48ef34cc08ae
      version: -1
      name: Are asset findings found?
      description: Returns 'yes' if asset findings found. Otherwise returns 'no'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "6"
      - "14"
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: RiskSense.HostFinding.ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 265,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 9f36553b-2b15-4a90-85e0-65c486068d89
    type: title
    task:
      id: 9f36553b-2b15-4a90-85e0-65c486068d89
      version: -1
      name: Get assets findings with the asset and perform actions
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 8023da73-46df-44a8-8355-9876a09da604
    type: title
    task:
      id: 8023da73-46df-44a8-8355-9876a09da604
      version: -1
      name: Blocks IP addresses (requires at least one integration)
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1055
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: ea128f99-f05a-47c6-8893-1c42fa831a2a
    type: regular
    task:
      id: ea128f99-f05a-47c6-8893-1c42fa831a2a
      version: -1
      name: Get asset information with owner
      description: Gets details of the supplied host. The host details can be searched based on input parameters like fieldname (Host Name, IP Address, Criticality, etc), operator (EXACT, IN, LIKE, BETWEEN), page, size, sort by, and sort direction.
      script: '|||risksense-get-hosts'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      exclude: {}
      fieldname:
        simple: id
      operator:
        simple: IN
      page: {}
      size:
        simple: "1000"
      sort_by:
        simple: RS3
      sort_direction:
        simple: Descending
      value:
        complex:
          root: RiskSense
          accessor: HostFinding.HostID
          transformers:
          - operator: uniq
          - operator: Stringify
          - operator: join
            args:
              separator:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: 4083fb31-386a-4e65-8a14-78b53786244d
    type: regular
    task:
      id: 4083fb31-386a-4e65-8a14-78b53786244d
      version: -1
      name: Apply tag to found asset findings
      description: Apply the new or existing tag to the asset, or creates a new tag if it does not exist in RiskSense.
      script: '|||risksense-apply-tag'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      assettype:
        simple: hostFinding
      exclude: {}
      fieldname:
        simple: id
      operator:
        simple: IN
      propagate_to_all_findings: {}
      tagname:
        complex:
          root: inputs.TagName
      value:
        complex:
          root: RiskSense
          accessor: HostFinding.ID
          transformers:
          - operator: uniq
          - operator: Stringify
          - operator: join
            args:
              separator:
                value:
                  simple: ','
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: b31a916a-9752-45fb-8354-5856a5124be6
    type: playbook
    task:
      id: b31a916a-9752-45fb-8354-5856a5124be6
      version: -1
      name: Block IP - Generic v2
      playbookName: Block IP - Generic v2
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      AutoCommit:
        simple: "No"
      CustomBlockRule:
        simple: "True"
      DAG: {}
      EDLServerIP: {}
      IP:
        complex:
          root: RiskSense
          accessor: HostFinding.HostIpAddress
          transformers:
          - operator: uniq
      IPBlacklistMiner: {}
      IPListName: {}
      LogForwarding: {}
      StaticAddressGroup: {}
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 910,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 7a49df8d-d2c9-44a4-897a-4ea385ed52f3
    type: condition
    task:
      id: 7a49df8d-d2c9-44a4-897a-4ea385ed52f3
      version: -1
      name: Are Inputs provided?
      description: Returns 'yes' if inputs are provided. Otherwise returns 'no'.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.CVES
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.TagName
            iscontext: true
    view: |-
      {
        "position": {
          "x": 130,
          "y": 175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "12_10_#default#": 0.17,
      "12_15_yes": 0.76,
      "18_1_yes": 0.18,
      "1_10_#default#": 0.8
    },
    "paper": {
      "dimensions": {
        "height": 1535,
        "width": 1510,
        "x": -220,
        "y": 40
      }
    }
  }
inputs:
- key: CVES
  value: {}
  required: true
  description: Specify Common Vulnerabilities and Exposures (CVE). You can mention multiple CVEs using a comma-separated list.
  playbookInputQuery:
- key: TagName
  value: {}
  required: true
  description: Tags in RiskSense can be applied to assets, web applications, and vulnerabilities. Tags are useful in the soft grouping, workflow creation and to identify compliance-related assets.
  playbookInputQuery:
outputs:
- contextPath: RiskSense.TagAssociation
  description: Tag association details including tag name, association ID, created.
  type: unknown
- contextPath: RiskSense.HostFinding
  description: List of the host finding details.
  type: unknown
- contextPath: RiskSense.Host
  description: List of the host details.
  type: unknown
fromversion: 5.0.0
tests:
- No tests (auto formatted)