cve-enrichment

Enriches CVE indicators with reputation data from multiple integrations and outputs a consolidated CVEEnrichment object. This script exclusively supports indicators of type CVE and will automatically create the indicator in TIM if it is not already exists.

python · Aggregated Scripts

Details

IDcve-enrichment
Languagepython
From Version8.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Tagsbasescript

README

Enriches CVE indicators with reputation data from multiple integrations and outputs a consolidated CVEEnrichment object. This script exclusively supports indicators of type CVE and will automatically create the indicator in TIM if it is not already exists.
Note: This script is supported in Cortex XSOAR 8.0 and later, and in Cortex XSIAM.

Script Data

Name Description
Script Type python3
Tags basescript
Cortex XSOAR Version 8.0.0

Used In

This script is used in the following playbooks and scripts.

  • CVEEnrichment-Test

Inputs

Argument Name Description
cve_list A comma-separated list of CVEs to enrich.
external_enrichment Whether to call external integrations for enrichment.
- ‘true’: enrich using enabled external integrations (e.g., CIRCL CVE Search, CVE Search v2).
- ‘false’: use only existing TIM data; skip external integrations.
If the ‘brands’ argument is provided, this flag is ignored and enrichment is run only on the brands provided.
verbose Whether to retrieve a human-readable entry for every command; if false, only the final result is summarized and error entries are suppressed.
brands A list of integration brands to run enrichment against.
Example: `“CIRCL CVE Search, CVE Search v2”`.
- If provided, only the selected brands are used.
- If left empty, the script runs enrichment on all enabled integrations,
depending on the `external_enrichment` flag.
To see the available brands for the `cve` command, run: `!ProvidesCommand command=cve`.
additional_fields When set to true, the output will also include an `AdditionalFields` object
for each of the indicator result.
`AdditionalFields` contains all fields returned by TIM or the integrations
that are not part of the standard output keys: `ID`, `Brand`, `CVSS`,
`Description`, `Published`.
When set to false, only the standard keys are returned.

Outputs

Path Description Type
CVEEnrichment.Value The CVE. string
CVEEnrichment.MaxCVSS The max CVSS of the indicator. number
CVEEnrichment.MaxCVSSRating The max CVSS rating of the indicator. string
CVEEnrichment.Results List of all indicators found for the CVE. array
CVEEnrichment.Status The status of the indicator. string
CVEEnrichment.Results.ID The ID of the indicator. string
CVEEnrichment.Results.Brand The brand of the indicator. string
CVEEnrichment.Results.CVSS The CVSS of the indicator. number
CVEEnrichment.Results.Description The description of the indicator. string
CVEEnrichment.Results.Published The published date of the indicator. string
CVEEnrichment.Results.Status The status of the indicator: “Manual” if the score was changed manually, “Fresh” if modified within the last week, “Stale” if modified more than a week ago, and “None” if never modified. string
CVEEnrichment.Results.ModifiedTime The time the indicator was last modified. Date
CVEEnrichment.Results.AdditionalFields All fields extracted from the indicator other then the main keys (“ID”, “Brand”, “CVSS”, “Description”, “Published”, “CVSS”). Object
CVEEnrichment.Results.AdditionalFields.Relationships.EntityA The source of the relationship. string
CVEEnrichment.Results.AdditionalFields.Relationships.EntityB The destination of the relationship. string
CVEEnrichment.Results.AdditionalFields.Relationships.Relationship The name of the relationship. string
CVEEnrichment.Results.AdditionalFields.Relationships.EntityAType The type of the source of the relationship. string
CVEEnrichment.Results.AdditionalFields.Relationships.EntityBType The type of the destination of the relationship. string
CVEEnrichment.Results.AdditionalFields.Modified The timestamp of when the CVE was last modified. Date

Source

CVEEnrichment.py CVEEnrichment_test.py CVEEnrichment.yml
Download History Raw 
args:
- description: A comma-separated list of CVEs to enrich.
  name: cve_list
  required: true
  isArray: true
- name: external_enrichment
  description: |
    Whether to call external integrations for enrichment.
    - 'true': enrich using enabled external integrations (e.g., CIRCL CVE Search, CVE Search v2).
    - 'false': use only existing TIM data; skip external integrations.
    If the 'brands' argument is provided, this flag is ignored and enrichment is run only on the brands provided.
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  defaultValue: 'false'
  required: false
- name: verbose
  description: Whether to retrieve a human-readable entry for every command; if false, only the final result is summarized and error entries are suppressed.
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  defaultValue: 'false'
  required: false
- name: brands
  description: |
    A list of integration brands to run enrichment against.  
    Example: `"CIRCL CVE Search, CVE Search v2"`.  
    - If provided, only the selected brands are used. 
    - If left empty, the script runs enrichment on all enabled integrations,
      depending on the `external_enrichment` flag.
    To see the available brands for the `cve` command, run: `!ProvidesCommand command=cve`.
  isArray: true
  required: false
- name: additional_fields
  description: |
    When set to true, the output will also include an `AdditionalFields` object
    for each of the indicator result.  
    `AdditionalFields` contains all fields returned by TIM or the integrations
    that are not part of the standard output keys: `ID`, `Brand`, `CVSS`, 
    `Description`, `Published`.  
    When set to false, only the standard keys are returned.
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  required: false
  defaultValue: 'false'
comment: 'Enriches CVE indicators with reputation data from multiple integrations and outputs a consolidated CVEEnrichment object. This script exclusively supports indicators of type CVE and will automatically create the indicator in TIM if it is not already exists.'
commonfields:
  id: cve-enrichment
  version: -1
enabled: false
name: cve-enrichment
outputs:
# CVEEnrichment
- contextPath: CVEEnrichment.Value
  description: The CVE.
  type: string
- contextPath: CVEEnrichment.TIMCVSS
  description: The max CVSS of the indicator.
  type: number
- contextPath: CVEEnrichment.Results
  description: List of all indicators found for the CVE.
  type: array
- contextPath: CVEEnrichment.Status
  description: 'The status of the indicator: "Manual" if the score was changed manually, "Fresh" if modified within the last week, "Stale" if modified more than a week ago, "Error" if enrichment Failed, and "None" if never modified.'
  type: string
- contextPath: CVEEnrichment.Message
  description: The error message explaining the reason for the failure (e.g., "Invalid", "createIndicator failed", etc.).
  type: string
# CVEEnrichment Main Keys
- contextPath: CVEEnrichment.Results.ID
  description: The ID of the indicator.
  type: string
- contextPath: CVEEnrichment.Results.Brand
  description: The brand of the indicator.
  type: string
- contextPath: CVEEnrichment.Results.CVSS
  description: The CVSS of the indicator.
  type: number
- contextPath: CVEEnrichment.Results.Description
  description: The description of the indicator.
  type: string
- contextPath: CVEEnrichment.Results.Published
  description: The published date of the indicator.
  type: string
- contextPath: CVEEnrichment.Results.Status
  description: 'The status of the indicator: "Manual" if the score was changed manually, "Fresh" if modified within the last week, "Stale" if modified more than a week ago, and "None" if never modified.'
  type: string
- contextPath: CVEEnrichment.Results.ModifiedTime
  description: The time the indicator was last modified.
  type: Date
# CVEEnrichment Additional Fields
- contextPath: CVEEnrichment.Results.AdditionalFields
  description: All fields extracted from the indicator other then the main keys ("ID", "Brand", "CVSS", "Description", "Published", "CVSS").
  type: Object
- contextPath: CVEEnrichment.Results.AdditionalFields.Relationships.EntityA
  description: The source of the relationship.
  type: string
- contextPath: CVEEnrichment.Results.AdditionalFields.Relationships.EntityB
  description: The destination of the relationship.
  type: string
- contextPath: CVEEnrichment.Results.AdditionalFields.Relationships.Relationship
  description: The name of the relationship.
  type: string
- contextPath: CVEEnrichment.Results.AdditionalFields.Relationships.EntityAType
  description: The type of the source of the relationship.
  type: string
- contextPath: CVEEnrichment.Results.AdditionalFields.Relationships.EntityBType
  description: The type of the destination of the relationship.
  type: string
- contextPath: CVEEnrichment.Results.AdditionalFields.Modified
  description: The timestamp of when the CVE was last modified.
  type: Date
script: '-'
system: false
tags:
- basescript
timeout: '0'
type: python
subtype: python3
dockerimage: demisto/python3:3.12.13.10116658
fromversion: 8.0.0
marketplaces:
- xsoar_saas
- marketplacev2
- platform
tests:
- CVEEnrichment-Test