Recorded Future CVE Reputation

CVE reputation with Recorded Future SOAR enrichment

Recorded Future Intelligence · 7 tasks · 1 input · 16 outputs

Details

ID	`Recorded Future CVE Reputation`
From Version	5.0.0
Tasks	7

README

CVE reputation with Recorded Future SOAR Enrichment

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts. Depends on the recorded futures indicator field; risk rules.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Recorded Future v2

Scripts

This playbook does not use any scripts.

Commands

Playbook Inputs

Name	Description	Default Value	Required
CVE	The CVE ID to get reputation of.	CVE.ID	Optional

Playbook Outputs

Path	Description	Type
DBotScore.Indicator	The indicator that was tested	string
DBotScore.Type	Indicator type	string
DBotScore.Vendor	Vendor used to calculate the score	string
DBotScore.Score	The actual score	number
CVE.ID	Vulnerability name	string
RecordedFuture.CVE.riskLevel	Recorded Future Vulnerability Risk Level	string
RecordedFuture.CVE.riskScore	Risk Score	number
RecordedFuture.CVE.Evidence.rule	Recorded Risk Rule Name	string
RecordedFuture.CVE.Evidence.mitigation	Recorded Risk Rule Mitigation	string
RecordedFuture.CVE.Evidence.description	Recorded Risk Rule description	string
RecordedFuture.CVE.Evidence.timestamp	Recorded Risk Rule timestamp	date
RecordedFuture.CVE.Evidence.level	Recorded Risk Rule Level	number
RecordedFuture.CVE.Evidence.ruleid	Recorded Risk Rule ID	string
RecordedFuture.CVE.name	Vulnerability name	string
RecordedFuture.CVE.maxRules	Maximum count of Recorded Future Vulnerability Risk Rules	number
RecordedFuture.CVE.ruleCount	Number of triggered Recorded Future Vulnerability Risk Rules	number

Playbook Image

Recorded Future CVE Reputation

Inputs

CVE — The CVE ID for which to get the reputation.

Outputs

DBotScore.Indicator — The indicator that was tested
DBotScore.Type — Indicator type
DBotScore.Vendor — Vendor used to calculate the score
DBotScore.Score — The actual score
CVE.ID — Vulnerability name
RecordedFuture.CVE.riskLevel — Recorded Future vulnerability risk level
RecordedFuture.CVE.riskScore — Risk score
RecordedFuture.CVE.Evidence.rule — Recorded Future risk rule name
RecordedFuture.CVE.Evidence.mitigation — Recorded Future risk rule mitigation
RecordedFuture.CVE.Evidence.description — Recorded Future risk rule description
RecordedFuture.CVE.Evidence.timestamp — Recorded Future risk rule timestamp
RecordedFuture.CVE.Evidence.level — Recorded Future risk rule level
RecordedFuture.CVE.Evidence.ruleid — Recorded Future risk rule ID
RecordedFuture.CVE.name — Vulnerability name
RecordedFuture.CVE.maxRules — Maximum count of Recorded Future vulnerability risk rules
RecordedFuture.CVE.ruleCount — Number of triggered Recorded Future vulnerability risk rules

Commands used

cve setIndicator

Flowchart

Source

playbook-Recorded_Future_CVE_Reputation.yml

Download History Raw

id: Recorded Future CVE Reputation
version: -1
name: Recorded Future CVE Reputation
description: CVE reputation with Recorded Future SOAR enrichment
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 812bc576-9c30-453e-8b30-7671d8c68ade
    type: start
    task:
      id: 812bc576-9c30-453e-8b30-7671d8c68ade
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: 52d6c5d0-d5b3-467c-8410-766e7c274632
    type: condition
    task:
      id: 52d6c5d0-d5b3-467c-8410-766e7c274632
      version: -1
      name: Is there a CVE ID to get reputation of?
      description: Checks whether the playbook's input contains at least one domain
        name for which to retrieve the reputation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.CVE
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "24":
    id: "24"
    taskid: ebb1418e-2cee-43ba-898b-dd3d039db302
    type: title
    task:
      id: ebb1418e-2cee-43ba-898b-dd3d039db302
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "26":
    id: "26"
    taskid: e94dae4a-53ae-4f18-8e09-e4e6f6b85de8
    type: condition
    task:
      id: e94dae4a-53ae-4f18-8e09-e4e6f6b85de8
      version: -1
      name: Is Recorded Future API enabled?
      description: Checks if there is an active instance of the Recorded Future API
        integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: containsString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Recorded Future v2
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 410,
          "y": 505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "28":
    id: "28"
    taskid: b4ebb4f7-615c-465b-8927-9b23e38dbe53
    type: regular
    task:
      id: b4ebb4f7-615c-465b-8927-9b23e38dbe53
      version: -1
      name: Get CVE reputation from Recorded Future
      description: Get a quick indicator of the risk associated with a specific CVE.
      script: Recorded Future v2|||cve
      type: regular
      iscommand: true
      brand: Recorded Future v2
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      cve:
        simple: ${inputs.CVE}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 530,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "29":
    id: "29"
    taskid: 11c140fa-79ce-4595-84ac-6274a0b9b7f4
    type: title
    task:
      id: 11c140fa-79ce-4595-84ac-6274a0b9b7f4
      version: -1
      name: Get reputation using Recorded Future API
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 410,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: 617ca2be-df7c-4921-86e4-513b1d4df570
    type: regular
    task:
      id: 617ca2be-df7c-4921-86e4-513b1d4df570
      version: -1
      name: setIndicator
      description: Change the properties of an indicator
      script: Builtin|||setIndicator
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      recordedfutureriskrules:
        simple: ${RecordedFuture.CVE.rules}
      value:
        simple: ${inputs.CVE}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 530,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "16_24_#default#": 0.57,
      "26_24_#default#": 0.55,
      "26_28_yes": 0.61
    },
    "paper": {
      "dimensions": {
        "height": 895,
        "width": 860,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: CVE
  value:
    complex:
      root: CVE
      accessor: ID
  required: false
  description: The CVE ID for which to get the reputation.
  playbookInputQuery:
outputs:
- contextPath: DBotScore.Indicator
  description: The indicator that was tested
  type: string
- contextPath: DBotScore.Type
  description: Indicator type
  type: string
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
  type: string
- contextPath: DBotScore.Score
  description: The actual score
  type: number
- contextPath: CVE.ID
  description: Vulnerability name
  type: string
- contextPath: RecordedFuture.CVE.riskLevel
  description: Recorded Future vulnerability risk level
  type: string
- contextPath: RecordedFuture.CVE.riskScore
  description: Risk score
  type: number
- contextPath: RecordedFuture.CVE.Evidence.rule
  description: Recorded Future risk rule name
  type: string
- contextPath: RecordedFuture.CVE.Evidence.mitigation
  description: Recorded Future risk rule mitigation
  type: string
- contextPath: RecordedFuture.CVE.Evidence.description
  description: Recorded Future risk rule description
  type: string
- contextPath: RecordedFuture.CVE.Evidence.timestamp
  description: Recorded Future risk rule timestamp
  type: date
- contextPath: RecordedFuture.CVE.Evidence.level
  description: Recorded Future risk rule level
  type: number
- contextPath: RecordedFuture.CVE.Evidence.ruleid
  description: Recorded Future risk rule ID
  type: string
- contextPath: RecordedFuture.CVE.name
  description: Vulnerability name
  type: string
- contextPath: RecordedFuture.CVE.maxRules
  description: Maximum count of Recorded Future vulnerability risk rules
  type: number
- contextPath: RecordedFuture.CVE.ruleCount
  description: Number of triggered Recorded Future vulnerability risk rules
  type: number
tests:
- Recorded Future Test Playbook
fromversion: 5.0.0