DarkmonFilterCVEs
Filters CVEs by CVSS minimum and intersection with a tech-stack tag list.
python · Darkmon
Source
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 def main(): args = demisto.args() items = argToList(args.get("items")) or [] min_cvss = float(args.get("min_cvss", "9.0")) tech_list_name = args.get("tech_stack_list") res = demisto.executeCommand("getList", {"listName": tech_list_name}) if tech_list_name else None content = (res[0].get("Contents", "") if res else "") or "" tech = [t.strip().lower() for t in content.replace(",", "\n").splitlines() if t.strip()] out = [] for it in items: try: score = float(it.get("cvssScore") or 0) except (TypeError, ValueError): score = 0 if score < min_cvss: continue if tech: tags = [str(t).lower() for t in (it.get("tags") or [])] if not any(t in tags for t in tech): continue out.append(it) return_results({"FilteredCVEs": out}) if __name__ in ("__main__", "__builtin__", "builtins"): main()
README
Filters CVEs by CVSS minimum and intersection with a tech-stack tag list.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | darkmon |
| Cortex XSOAR Version | 6.5.0 |
Inputs
| Argument Name | Description |
|---|---|
| items | Items to process. |
| id_field | Field name to use as the dedup key. |
| seen_list | Name of the XSOAR List storing already-seen IDs. |
| domain_filter_list | Optional - list of customer domains to filter username matches. |
| domain_match_field | Field on each item to match against domain_filter_list. |
| allowlist | Optional list of usernames/DNs that must NEVER be actioned. |
| allowlist_match_field | Field to match against the allowlist. |
| incident_type | Incident type for newly created incidents. |
| severity | Severity (1=Low, 2=Medium, 3=High, 4=Critical). |
| name_template | Incident name template (supports ${field} interpolation). |
| field_map | Comma-separated ‘fieldCli=sourcePath’ pairs. |
| emails | Email addresses to fan out per VIP fetch. |
| domains | Optional list of customer domains to filter domain-based matches. |
| brands_list | Name of the XSOAR List containing brand names for NRD brand-watch matching. |
| max_distance | Maximum Levenshtein distance allowed when matching NRD domains against brand names. |
| min_cvss | Minimum CVSS score threshold; CVEs below this value are excluded. |
| tech_stack_list | Name of the XSOAR List containing tech-stack tags used to filter CVEs by relevance. |
Outputs
| Path | Description | Type |
|---|---|---|
| NewAccounts | Newly discovered account records that have not been previously actioned. | unknown |
| CreatedIncidents | Incidents created during this execution run. | unknown |
| Count | Total count of new items processed. | number |
| Typosquats | NRD domains identified as potential typosquats of monitored brand names. | unknown |
| FilteredCVEs | CVEs that passed the CVSS and tech-stack filters. | unknown |
| VIPCreated | Number of VIP-related incidents created during this execution. | number |