cveReputationV2

Provides the severity of the CVE based on the CVSS score where available.

python · Common Scripts

Details

IDcveReputationV2
Languagepython
From Version6.5.0
Docker Imagedemisto/python3:3.12.13.10404775
Tagscve reputation

README

Provides the severity of the CVE based on the CVSS score where available.

Script Data


Name Description
Script Type python3
Tags cve, reputation
Cortex XSOAR Version 6.5.0

Dependencies


This script uses the following commands and scripts.

cve

Used In


This script is used in the following playbooks and scripts.

CVE Enrichment - Generic

Inputs


Argument Name Description
input CVE ID.

Outputs


There are no outputs for this script.

import demistomock as demisto
from CommonServerPython import *


def get_dbot_score(resCmd: list[dict[str, Any]]) -> list[dict[str, Any]]:
    """
    Gets the CVE and returns its reputation according to its CVSS score.

    Args:
        resCmd (list[CommandResults]): A CVE indicator

    Returns:
        int: either 0,1,2 or 3 depending on the CVSS
    """

    results = []
    for cve in resCmd:
        if "Contents" in cve:
            data = cve.get("Contents", {})
            cvss = data.get("cvss", -1)

            if not cvss:
                cvss = -1

            elif isinstance(cvss, dict):
                score = data.get("cvss").get("Score", -1)
                cvss = float(score) if score else -1

            if cvss == -1:
                res = 0
            elif cvss < 3:
                res = 1
            elif cvss < 7:
                res = 2
            else:
                res = 3

            results.append(
                {
                    "Type": entryTypes["note"],
                    "ContentsFormat": formats["json"],
                    "Contents": res,
                    "EntryContext": {"DBotScore": {"Indicator": data.get("id"), "Type": "CVE", "Score": res, "Vendor": "DBot"}},
                }
            )

    return results


def main():
    cves = argToList(demisto.args().get("input"))
    resCmd = demisto.executeCommand("cve", {"cve": cves})
    results = get_dbot_score(resCmd)

    if len(results) == 0:
        # resCmd is expected to be empty result
        return_results(resCmd)

    else:
        return_results(results)


if __name__ in ("__main__", "builtin", "builtins"):
    main()