Kenna - Search and Handle Asset Vulnerabilities

This playbook accepts an asset, then searches for vulnerabilities on that asset using the Kenna integration. If a vulnerability exists, it looks for relevant patches, lets the analyst deploy them and then generates an investigation summary report.

Kenna · 15 tasks · 2 inputs · 7 outputs

Details

ID	`Kenna - Search and Handle Asset Vulnerabilities`
From Version	5.0.0
Tasks	15

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

GenerateInvestigationSummaryReport

Commands

kenna-search-vulnerabilities
kenna-search-assets
kenna-update-asset
kenna-search-fixes
kenna-get-asset-vulnerabilities

Playbook Inputs

Name	Description	Default Value	Required
hostname	Hostname to search.		Optional
host_id	Kenna host ID to search.		Optional

Playbook Outputs

Path	Description	Type
Report.Name	Report file name.	string
Report.FileID	File ID of the report.	string
Kenna.Vulnerabilities.ID	The vulnerability ID.	unknown
Kenna.VulnerabilitiesOfAsset.ID	The ID of the vulnerability associated with the the asset.	unknown
Kenna.Fixes.ID	The fix ID.	unknown
Kenna.Fixes.Assets.ID	The asset ID related to the current fix.	unknown
Kenna.Fixes.Vulnerabilities.ID	The vulnerability ID related to the current fix.	unknown

Playbook Image

Kenna - Search and Handle Asset Vulnerabilities

Inputs

hostname — Hostname to search.
host_id — Kenna host ID to search.

Outputs

Report.Name — Report file name.
Report.FileID — File ID of the report.
Kenna.Vulnerabilities.ID — The vulnerability ID.
Kenna.VulnerabilitiesOfAsset.ID — The ID of the vulnerability associated with the the asset.
Kenna.Fixes.ID — The fix ID.
Kenna.Fixes.Assets.ID — The asset ID related to the current fix.
Kenna.Fixes.Vulnerabilities.ID — The vulnerability ID related to the current fix.

Commands used

kenna-get-asset-vulnerabilities kenna-search-assets kenna-search-fixes kenna-search-vulnerabilities kenna-update-asset

Flowchart

Source

playbook-Kenna_-_Vulnerability_Handling.yml

Download History Raw

id: Kenna - Search and Handle Asset Vulnerabilities
version: -1
fromversion: 5.0.0
name: Kenna - Search and Handle Asset Vulnerabilities
description: This playbook accepts an asset, then searches for vulnerabilities on that asset using the Kenna integration. If a vulnerability exists, it looks for relevant patches, lets the analyst deploy them and then generates an investigation summary report.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: c9901727-39fe-43b9-8d68-a6957da9e30d
    type: start
    task:
      id: c9901727-39fe-43b9-8d68-a6957da9e30d
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": -520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: f4980703-8d81-44c7-83a4-60d8271e08c6
    type: title
    task:
      id: f4980703-8d81-44c7-83a4-60d8271e08c6
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1935
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: 56527b1b-e40b-4704-8694-a214d821c624
    type: title
    task:
      id: 56527b1b-e40b-4704-8694-a214d821c624
      version: -1
      name: CVE enrichment
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 650,
          "y": 365
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: 6ea0dd13-c5d2-4734-8703-b05c9972f7d1
    type: condition
    task:
      id: 6ea0dd13-c5d2-4734-8703-b05c9972f7d1
      version: -1
      name: Are there available fixes?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Kenna
                accessor: Fixes.ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: c6207ea1-0976-41d3-8636-17088f23b054
    type: regular
    task:
      id: c6207ea1-0976-41d3-8636-17088f23b054
      version: -1
      name: Manually deploy patch
      description: ""
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 1400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: 692f4ab3-8daa-4c7c-86d1-1e610334de44
    type: regular
    task:
      id: 692f4ab3-8daa-4c7c-86d1-1e610334de44
      version: -1
      name: Generate investigation summary report
      description: |-
        A script that generates an investigation summary report. It can
        be used in a post-processing flow as well.
      scriptName: GenerateInvestigationSummaryReport
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      incidentId: {}
      name: {}
      type: {}
    separatecontext: false
    skipunavailable: true
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1760
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "17":
    id: "17"
    taskid: 6e60fb9f-34ba-4dc8-8f65-6ca730416a75
    type: regular
    task:
      id: 6e60fb9f-34ba-4dc8-8f65-6ca730416a75
      version: -1
      name: Kenna - search vulnerability
      description: Searches for vulnerabilities in Kenna.
      script: '|||kenna-search-vulnerabilities'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      id:
        complex:
          root: Kenna
          accessor: VulnerabilitiesOfAsset.ID
      limit: {}
      min-score: {}
      status: {}
      to_context: {}
      top-priority: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 650,
          "y": 520
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "18":
    id: "18"
    taskid: fb35ed00-0191-4630-8a07-9a41dc0f837d
    type: regular
    task:
      id: fb35ed00-0191-4630-8a07-9a41dc0f837d
      version: -1
      name: Kenna - get asset vulnerabilities
      description: Gets vulnerabilities of the specified asset.
      script: '|||kenna-get-asset-vulnerabilities'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      id:
        complex:
          root: Kenna
          accessor: Assets.ID
      limit: {}
      to_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 650,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "19":
    id: "19"
    taskid: 9bfa446c-4fff-4a9b-82ac-3aa4b5e7f085
    type: regular
    task:
      id: 9bfa446c-4fff-4a9b-82ac-3aa4b5e7f085
      version: -1
      name: Kenna - search assets
      description: Searches for assets.
      script: '|||kenna-search-assets'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      hostname:
        complex:
          root: inputs.hostname
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.hostname
                iscontext: true
      id:
        complex:
          root: inputs.host_id
      limit: {}
      min-score: {}
      tags: {}
      to_context: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 650,
          "y": -30
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "20":
    id: "20"
    taskid: edefc5de-0585-4b2e-837c-ef0963d91ed6
    type: regular
    task:
      id: edefc5de-0585-4b2e-837c-ef0963d91ed6
      version: -1
      name: Kenna - search fixes
      description: Filters fixes by a given set of vulnerability and asset parameters and returns the filtered fixes.
      script: '|||kenna-search-fixes'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      id:
        complex:
          root: Kenna
          accessor: Vulnerabilities.ID
      limit: {}
      min-score: {}
      status: {}
      to_context: {}
      top-priority: {}
      vulnerabilities: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "21":
    id: "21"
    taskid: 6762ce1a-c1f2-4a01-8483-2bdab72945e3
    type: regular
    task:
      id: 6762ce1a-c1f2-4a01-8483-2bdab72945e3
      version: -1
      name: Kenna - add note for asset
      description: Add a comment for the asset describing the patch.
      script: '|||kenna-update-asset'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      id:
        complex:
          root: Kenna
          accessor: Assets.ID
      notes:
        simple: Patched for vulnerability ${Kenna.Fixes.Vulnerabilities.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1220,
          "y": 1590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "22":
    id: "22"
    taskid: cfba542c-fbd4-45fd-8cf0-6653c237a697
    type: condition
    task:
      id: cfba542c-fbd4-45fd-8cf0-6653c237a697
      version: -1
      name: Were any vulnerabilities found?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "20"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Kenna
                accessor: Vulnerabilities.ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 650,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "23":
    id: "23"
    taskid: 75dc8cb1-8b02-4d80-8ef4-e71dba6a4ecd
    type: title
    task:
      id: 75dc8cb1-8b02-4d80-8ef4-e71dba6a4ecd
      version: -1
      name: Remediation
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 650,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "24":
    id: "24"
    taskid: edb2be78-4470-4f0f-82fa-3d0aec9dc695
    type: condition
    task:
      id: edb2be78-4470-4f0f-82fa-3d0aec9dc695
      version: -1
      name: Is there a host to search?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.hostname
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.host_id
            iscontext: true
    view: |-
      {
        "position": {
          "x": 360,
          "y": -200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "25":
    id: "25"
    taskid: 96f5131e-4cae-4ed3-8022-43e4093d6b1e
    type: condition
    task:
      id: 96f5131e-4cae-4ed3-8022-43e4093d6b1e
      version: -1
      name: Is Kenna v2 integration enabled?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "24"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Kennav2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": -370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "11_13_yes": 0.51,
      "11_14_#default#": 0.39,
      "22_20_yes": 0.59,
      "22_9_#default#": 0.28,
      "24_9_#default#": 0.11,
      "25_9_#default#": 0.11
    },
    "paper": {
      "dimensions": {
        "height": 2520,
        "width": 1550,
        "x": 50,
        "y": -520
      }
    }
  }
inputs:
- key: hostname
  value: {}
  required: false
  description: Hostname to search.
- key: host_id
  value: {}
  required: false
  description: Kenna host ID to search.
outputs:
- contextPath: Report.Name
  description: Report file name.
  type: string
- contextPath: Report.FileID
  description: File ID of the report.
  type: string
- contextPath: Kenna.Vulnerabilities.ID
  description: The vulnerability ID.
- contextPath: Kenna.VulnerabilitiesOfAsset.ID
  description: The ID of the vulnerability associated with the the asset.
- contextPath: Kenna.Fixes.ID
  description: The fix ID.
- contextPath: Kenna.Fixes.Assets.ID
  description: The asset ID related to the current fix.
- contextPath: Kenna.Fixes.Vulnerabilities.ID
  description: The vulnerability ID related to the current fix.
tests:
- No Test