DarkmonFilterCVEs

Details

ID	`DarkmonFilterCVEs`
Language	python
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	darkmon

README

Filters CVEs by CVSS minimum and intersection with a tech-stack tag list.

Script Data

Name	Description
Script Type	python3
Tags	darkmon
Cortex XSOAR Version	6.5.0

Inputs

Argument Name	Description
items	Items to process.
id_field	Field name to use as the dedup key.
seen_list	Name of the XSOAR List storing already-seen IDs.
domain_filter_list	Optional - list of customer domains to filter username matches.
domain_match_field	Field on each item to match against domain_filter_list.
allowlist	Optional list of usernames/DNs that must NEVER be actioned.
allowlist_match_field	Field to match against the allowlist.
incident_type	Incident type for newly created incidents.
severity	Severity (1=Low, 2=Medium, 3=High, 4=Critical).
name_template	Incident name template (supports ${field} interpolation).
field_map	Comma-separated ‘fieldCli=sourcePath’ pairs.
emails	Email addresses to fan out per VIP fetch.
domains	Optional list of customer domains to filter domain-based matches.
brands_list	Name of the XSOAR List containing brand names for NRD brand-watch matching.
max_distance	Maximum Levenshtein distance allowed when matching NRD domains against brand names.
min_cvss	Minimum CVSS score threshold; CVEs below this value are excluded.
tech_stack_list	Name of the XSOAR List containing tech-stack tags used to filter CVEs by relevance.

Outputs

Path	Description	Type
NewAccounts	Newly discovered account records that have not been previously actioned.	unknown
CreatedIncidents	Incidents created during this execution run.	unknown
Count	Total count of new items processed.	number
Typosquats	NRD domains identified as potential typosquats of monitored brand names.	unknown
FilteredCVEs	CVEs that passed the CVSS and tech-stack filters.	unknown
VIPCreated	Number of VIP-related incidents created during this execution.	number

Source

DarkmonFilterCVEs.py DarkmonFilterCVEs_test.py DarkmonFilterCVEs.yml

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def main():
    args = demisto.args()
    items = argToList(args.get("items")) or []
    min_cvss = float(args.get("min_cvss", "9.0"))
    tech_list_name = args.get("tech_stack_list")

    res = demisto.executeCommand("getList", {"listName": tech_list_name}) if tech_list_name else None
    content = (res[0].get("Contents", "") if res else "") or ""
    tech = [t.strip().lower() for t in content.replace(",", "\n").splitlines() if t.strip()]

    out = []
    for it in items:
        try:
            score = float(it.get("cvssScore") or 0)
        except (TypeError, ValueError):
            score = 0
        if score < min_cvss:
            continue
        if tech:
            tags = [str(t).lower() for t in (it.get("tags") or [])]
            if not any(t in tags for t in tech):
                continue
        out.append(it)

    return_results({"FilteredCVEs": out})


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()