Darkmon - Critical CVE Pipeline

Daily filter of new CVEs (CVSS >= 9) against the customer's tech-stack tags. Matches open a 'Darkmon Critical CVE' incident per match and ticket via Generic Notify.

Darkmon · 9 tasks · 1 input · 1 output

Details

IDDarkmon - Critical CVE Pipeline
From Version6.8.0
Tasks9
Tagsdarkmon monitoring vulnerability-management

README

Daily filter of new CVEs (CVSS >= 9) against the customer’s tech-stack tags. Matches open a ‘Darkmon Critical CVE’ incident per match and ticket via Generic Notify.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Darkmon - Generic Notify

Integrations

  • Darkmon

Scripts

  • DarkmonCreateIncidents
  • DarkmonFilterCVEs
  • DarkmonFilterUnseen

Commands

  • dmontip-get-cve

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

Path Description Type
FilteredCVEs CVEs that passed the CVSS + tech-stack filter. unknown

Inputs

  • MinCVSS — Minimum CVSS score for a CVE to qualify as critical and create an incident. Defaults to 9.0 (Critical band per NVD). Lower to 7.0 to include High severity, or 8.5 to include borderline High/Critical.

Outputs

  • FilteredCVEs — CVEs that passed the CVSS + tech-stack filter.

Commands used

dmontip-get-cve

Flowchart

yes Start Start Fetch CVE feed - dmontip-get-cve Fetch CVE feed dmontip-get-cve Filter by CVSS >= 9 and tech-stack tags - DarkmonFilterCVEs Filter by CVSS >= 9 and t... DarkmonFilterCVEs Dedup against seen CVEs - DarkmonFilterUnseen Dedup against seen CVEs DarkmonFilterUnseen Open CVE remediation incidents - DarkmonCreateIncidents Open CVE remediation inci... DarkmonCreateIncidents File ticket with vuln-mgmt team - Darkmon - Generic Notify File ticket with vuln-mgm... Darkmon - Generic Notify Done Done Is Darkmon integration available? - IsIntegrationAvailable Is Darkmon integration av... IsIntegrationAvailable Done Done

Source

playbook-Darkmon_Critical_CVE_Pipeline.yml
Download History Raw 
id: Darkmon - Critical CVE Pipeline
version: -1
name: Darkmon - Critical CVE Pipeline
description: Daily filter of new CVEs (CVSS >= 9) against the customer's tech-stack tags. Matches open a 'Darkmon Critical CVE' incident per match and ticket via Generic Notify.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- monitoring
- vulnerability-management
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 72607c06-c96e-46d7-8d6d-20471a97117c
    type: start
    task:
      id: 72607c06-c96e-46d7-8d6d-20471a97117c
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '100'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: 53cb6799-4390-4d67-a775-8f74dbb33f71
    type: regular
    task:
      id: 53cb6799-4390-4d67-a775-8f74dbb33f71
      version: -1
      name: Fetch CVE feed
      description: ''
      script: Darkmon|||dmontip-get-cve
      type: regular
      iscommand: true
      brand: Darkmon
    scriptarguments:
      size:
        simple: '200'
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: f21527bb-1f21-4c80-9698-624a978f87f1
    type: regular
    task:
      id: f21527bb-1f21-4c80-9698-624a978f87f1
      version: -1
      name: Filter by CVSS >= 9 and tech-stack tags
      description: ''
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonFilterCVEs
    scriptarguments:
      items:
        simple: ${{Darkmon.CVE}}
      min_cvss:
        simple: ${inputs.MinCVSS}
      tech_stack_list:
        simple: Darkmon - Tech Stack Tags
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '3':
    id: '3'
    taskid: e4568486-e083-4e96-90b2-71dc49493e37
    type: regular
    task:
      id: e4568486-e083-4e96-90b2-71dc49493e37
      version: -1
      name: Dedup against seen CVEs
      description: ''
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonFilterUnseen
    scriptarguments:
      items:
        simple: ${{FilteredCVEs}}
      id_field:
        simple: id
      seen_list:
        simple: Darkmon - Seen CVEs
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '4':
    id: '4'
    taskid: 1d10ea23-1828-445b-8bd4-0599f1ae1511
    type: regular
    task:
      id: 1d10ea23-1828-445b-8bd4-0599f1ae1511
      version: -1
      name: Open CVE remediation incidents
      description: ''
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonCreateIncidents
    scriptarguments:
      items:
        simple: ${{NewAccounts}}
      incident_type:
        simple: Darkmon Critical CVE
      severity:
        simple: '4'
      name_template:
        simple: 'Darkmon: ${{name}} (CVSS ${{cvssScore}})'
      field_map:
        simple: cve=name,cvss=cvssScore,darkmoncveseverity=severity,darkmonaffectedcomponents=tags
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '5':
    id: '5'
    taskid: da175fc2-3e51-4581-b6d1-f9a559fff887
    type: playbook
    task:
      id: da175fc2-3e51-4581-b6d1-f9a559fff887
      version: -1
      name: File ticket with vuln-mgmt team
      description: ''
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Darkmon - Generic Notify
    scriptarguments:
      Subject:
        simple: 'Darkmon: ${{NewAccounts.length}} critical CVEs intersect your stack'
      Body:
        simple: Open the Darkmon Critical CVE incidents in XSOAR for details.
    nexttasks:
      '#none#':
      - '6'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1490}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '6':
    id: '6'
    taskid: 2073c7b9-6473-4136-8032-004d4b7fde0d
    type: title
    task:
      id: 2073c7b9-6473-4136-8032-004d4b7fde0d
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1730}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '100':
    id: '100'
    taskid: c0b7b1cc-2920-4740-83ae-a130cea9ee30
    type: condition
    task:
      id: c0b7b1cc-2920-4740-83ae-a130cea9ee30
      version: -1
      name: Is Darkmon integration available?
      description: Skips the playbook gracefully if the Darkmon integration is not configured in this tenant. Calls the built-in IsIntegrationAvailable script with brandname=Darkmon.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    scriptarguments:
      brandname:
        simple: Darkmon
    results:
    - brandInstances
    nexttasks:
      'yes':
      - '1'
      '#default#':
      - '101'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '101':
    id: '101'
    taskid: 98cafe08-c4e9-41f8-b0cc-2ed9a72898cb
    type: title
    task:
      id: 98cafe08-c4e9-41f8-b0cc-2ed9a72898cb
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: '{"linkLabelsPosition": {"100_1_yes": 0.1, "100_101_#default#": 0.5}, "paper": {"dimensions": {"height": 1895, "width": 980, "x": -500, "y": 0}}}'
inputs:
- key: MinCVSS
  value:
    simple: '9.0'
  required: false
  description: Minimum CVSS score for a CVE to qualify as critical and create an incident. Defaults to 9.0 (Critical band per NVD). Lower to 7.0 to include High severity, or 8.5 to include borderline High/Critical.
  playbookInputQuery:
outputs:
- contextPath: FilteredCVEs
  description: CVEs that passed the CVSS + tech-stack filter.
  type: unknown
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security