Vulnerability Handling - Nexpose

Manage vulnerability remediation using Nexpose data, and optionally enrich data with 3rd-party tools. Before you run this playbook, run the "Vulnerability Management - Nexpose (Job)" playbook.
Rapid7 InsightVM · 14 tasks · 0 inputs · 0 outputs
Details

ID	`Vulnerability Handling - Nexpose`
From Version	5.0.0
Tasks	14
README

Manage vulnerability remediation using Nexpose data, and optionally enrich data with 3rd-party tools.
Before you run this playbook, run the “Vulnerability Management - Nexpose (Job)” playbook.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

CVE Enrichment - Generic v2
Endpoint Enrichment - Generic v2.1
Calculate Severity - 3rd-party integrations
Integrations

Rapid7 Nexpose
Scripts

This playbook does not use any scripts.
Commands

nexpose-get-asset
nexpose-get-asset-vulnerability
setIncident
closeInvestigation
Playbook Inputs

There are no inputs for this playbook.
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Vulnerability Handling - Nexpose
Commands used

closeInvestigation nexpose-get-asset nexpose-get-asset-vulnerability setIncident
Flowchart

Source

playbook-Vulnerability_Handling_-_Nexpose.yml
Download History Raw
id: Vulnerability Handling - Nexpose
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Vulnerability Handling - Nexpose
description: |-
  Manage vulnerability remediation using Nexpose data, and optionally enrich data with 3rd-party tools.

  Before you run this playbook, run the "Vulnerability Management - Nexpose (Job)" playbook.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d127e66f-7ade-4b3c-8ba2-60857698d3ee
    type: start
    task:
      id: d127e66f-7ade-4b3c-8ba2-60857698d3ee
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 356935d6-9ca3-4c10-8518-ce37b1eb878b
    type: condition
    task:
      id: 356935d6-9ca3-4c10-8518-ce37b1eb878b
      version: -1
      name: Is Nexpose enabled?
      description: Verify that there's a valid instance of Nexpose enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Rapid7 Nexpose
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 185
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: d0ea9b16-8e93-468a-8311-68805bbbe5e5
    type: title
    task:
      id: d0ea9b16-8e93-468a-8311-68805bbbe5e5
      version: -1
      name: Get vulnerability details from Nexpose
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 585,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: d553fc72-9bac-44e3-8c03-c295acd17f44
    type: title
    task:
      id: d553fc72-9bac-44e3-8c03-c295acd17f44
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 152.5,
          "y": 1855
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 8cff4db4-a188-42e4-84a4-d973febd4ea0
    type: regular
    task:
      id: 8cff4db4-a188-42e4-84a4-d973febd4ea0
      version: -1
      name: Get asset information
      description: Get asset metadata from Nexpose based on asset ID.
      script: Rapid7 Nexpose|||nexpose-get-asset
      type: regular
      iscommand: true
      brand: Rapid7 Nexpose
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      id:
        complex:
          root: incident
          accessor: assetid
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 370,
          "y": 505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: d17a5f7c-9bc4-4448-8b62-61efa02ca003
    type: regular
    task:
      id: d17a5f7c-9bc4-4448-8b62-61efa02ca003
      version: -1
      name: Get Vulnerability information
      description: Get vulnerability metadata from Nexpose based on vulnerability ID.
      script: Rapid7 Nexpose|||nexpose-get-asset-vulnerability
      type: regular
      iscommand: true
      brand: Rapid7 Nexpose
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      extend-context:
        simple: NexposeSeverity=severity
      id:
        complex:
          root: incident
          accessor: assetid
      vulnerabilityId:
        complex:
          root: incident
          accessor: vendorid
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 800,
          "y": 505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 206d337a-bae4-409c-890f-6a9fc6c28a5f
    type: title
    task:
      id: 206d337a-bae4-409c-890f-6a9fc6c28a5f
      version: -1
      name: Enrich Entities
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 585,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: df0d00fa-f883-4c1b-816d-bacd8a184730
    type: regular
    task:
      id: df0d00fa-f883-4c1b-816d-bacd8a184730
      version: -1
      name: Set custom fields
      description: |-
        Set the information retrieved from Nexpose into the vulnerability incident custom fields:
        * Vulnerability Category
        * CVE
        * CVSS
        * Signature
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      cve:
        complex:
          root: Nexpose
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Nexpose.Asset.Vulnerability.Id
                iscontext: true
              right:
                value:
                  simple: incident.vendorid
                iscontext: true
          accessor: Asset.Vulnerability.CVES
          transformers:
          - operator: uniq
          - operator: Stringify
      cvss:
        complex:
          root: Nexpose
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Nexpose.Asset.Vulnerability.Id
                iscontext: true
              right:
                value:
                  simple: incident.vendorid
                iscontext: true
          accessor: Asset.Vulnerability.CVSSScore
          transformers:
          - operator: uniq
          - operator: Stringify
      signature:
        complex:
          root: Nexpose
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Nexpose.Asset.Vulnerability.Id
                iscontext: true
              right:
                value:
                  simple: incident.vendorid
                iscontext: true
          accessor: Asset.Vulnerability.Title
          transformers:
          - operator: uniq
          - operator: Stringify
      vulnerabilitycategory:
        complex:
          root: Nexpose
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Nexpose.Asset.Vulnerability.Id
                iscontext: true
              right:
                value:
                  simple: incident.vendorid
                iscontext: true
          accessor: Asset.Vulnerability.Categories
          transformers:
          - operator: uniq
          - operator: Stringify
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 585,
          "y": 1000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 351a2cef-df14-4458-8deb-ca7c26c1b89b
    type: title
    task:
      id: 351a2cef-df14-4458-8deb-ca7c26c1b89b
      version: -1
      name: Remediate
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 585,
          "y": 1175
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: a469ee6e-9487-4e94-828b-72a7c5f439d9
    type: regular
    task:
      id: a469ee6e-9487-4e94-828b-72a7c5f439d9
      version: -1
      name: 'Remediate the vulnerability '
      description: |
        Manually remediate the vulnerability using the remediation notes from Nexpose.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 585,
          "y": 1495
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 3cc3fdfa-3601-49c5-82e6-56dffc6ecda1
    type: regular
    task:
      id: 3cc3fdfa-3601-49c5-82e6-56dffc6ecda1
      version: -1
      name: Close investigation
      description: Close the investigation.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 585,
          "y": 1670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 77f08004-0709-447d-8fe7-9853a7afe457
    type: playbook
    task:
      id: 77f08004-0709-447d-8fe7-9853a7afe457
      version: -1
      name: CVE Enrichment - Generic v2
      playbookName: CVE Enrichment - Generic v2
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 400,
          "y": 825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: e9cd00f2-b274-4a95-8b72-9c58a4fa8553
    type: playbook
    task:
      id: e9cd00f2-b274-4a95-8b72-9c58a4fa8553
      version: -1
      name: Calculate Severity - 3rd-party integrations
      playbookName: Calculate Severity - 3rd-party integrations
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 585,
          "y": 1315
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 4d236552-e282-4452-822c-baab1d8b67e9
    type: playbook
    task:
      id: 4d236552-e282-4452-822c-baab1d8b67e9
      version: -1
      name: Endpoint Enrichment - Generic v2.1
      playbookName: Endpoint Enrichment - Generic v2.1
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      Hostname:
        complex:
          root: Endpoint
          accessor: Hostname
          transformers:
          - operator: uniq
      IPAddress:
        complex:
          root: Endpoint
          accessor: IP
          transformers:
          - operator: uniq
      UseReputationCommand:
        simple: "False"
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 800,
          "y": 825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1870,
        "width": 1027.5,
        "x": 152.5,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
marketplaces:
- xsoar
tests:
- No tests (auto formatted)
fromversion: 5.0.0