DarkmonFilterCVEs

Filters CVEs by CVSS minimum and intersection with a tech-stack tag list.

python · Darkmon

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def main():
    args = demisto.args()
    items = argToList(args.get("items")) or []
    min_cvss = float(args.get("min_cvss", "9.0"))
    tech_list_name = args.get("tech_stack_list")

    res = demisto.executeCommand("getList", {"listName": tech_list_name}) if tech_list_name else None
    content = (res[0].get("Contents", "") if res else "") or ""
    tech = [t.strip().lower() for t in content.replace(",", "\n").splitlines() if t.strip()]

    out = []
    for it in items:
        try:
            score = float(it.get("cvssScore") or 0)
        except (TypeError, ValueError):
            score = 0
        if score < min_cvss:
            continue
        if tech:
            tags = [str(t).lower() for t in (it.get("tags") or [])]
            if not any(t in tags for t in tech):
                continue
        out.append(it)

    return_results({"FilteredCVEs": out})


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README

Filters CVEs by CVSS minimum and intersection with a tech-stack tag list.

Script Data


Name Description
Script Type python3
Tags darkmon
Cortex XSOAR Version 6.5.0

Inputs


Argument Name Description
items Items to process.
id_field Field name to use as the dedup key.
seen_list Name of the XSOAR List storing already-seen IDs.
domain_filter_list Optional - list of customer domains to filter username matches.
domain_match_field Field on each item to match against domain_filter_list.
allowlist Optional list of usernames/DNs that must NEVER be actioned.
allowlist_match_field Field to match against the allowlist.
incident_type Incident type for newly created incidents.
severity Severity (1=Low, 2=Medium, 3=High, 4=Critical).
name_template Incident name template (supports ${field} interpolation).
field_map Comma-separated ‘fieldCli=sourcePath’ pairs.
emails Email addresses to fan out per VIP fetch.
domains Optional list of customer domains to filter domain-based matches.
brands_list Name of the XSOAR List containing brand names for NRD brand-watch matching.
max_distance Maximum Levenshtein distance allowed when matching NRD domains against brand names.
min_cvss Minimum CVSS score threshold; CVEs below this value are excluded.
tech_stack_list Name of the XSOAR List containing tech-stack tags used to filter CVEs by relevance.

Outputs


Path Description Type
NewAccounts Newly discovered account records that have not been previously actioned. unknown
CreatedIncidents Incidents created during this execution run. unknown
Count Total count of new items processed. number
Typosquats NRD domains identified as potential typosquats of monitored brand names. unknown
FilteredCVEs CVEs that passed the CVSS and tech-stack filters. unknown
VIPCreated Number of VIP-related incidents created during this execution. number