DarkmonFilterCVEs

Details

ID	`DarkmonFilterCVEs`
Language	python
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	darkmon

README

Filters CVEs by CVSS minimum and intersection with a tech-stack tag list.

Script Data

Name	Description
Script Type	python3
Tags	darkmon
Cortex XSOAR Version	6.5.0

Inputs

Argument Name	Description
items	Items to process.
id_field	Field name to use as the dedup key.
seen_list	Name of the XSOAR List storing already-seen IDs.
domain_filter_list	Optional - list of customer domains to filter username matches.
domain_match_field	Field on each item to match against domain_filter_list.
allowlist	Optional list of usernames/DNs that must NEVER be actioned.
allowlist_match_field	Field to match against the allowlist.
incident_type	Incident type for newly created incidents.
severity	Severity (1=Low, 2=Medium, 3=High, 4=Critical).
name_template	Incident name template (supports ${field} interpolation).
field_map	Comma-separated ‘fieldCli=sourcePath’ pairs.
emails	Email addresses to fan out per VIP fetch.
domains	Optional list of customer domains to filter domain-based matches.
brands_list	Name of the XSOAR List containing brand names for NRD brand-watch matching.
max_distance	Maximum Levenshtein distance allowed when matching NRD domains against brand names.
min_cvss	Minimum CVSS score threshold; CVEs below this value are excluded.
tech_stack_list	Name of the XSOAR List containing tech-stack tags used to filter CVEs by relevance.

Outputs

Path	Description	Type
NewAccounts	Newly discovered account records that have not been previously actioned.	unknown
CreatedIncidents	Incidents created during this execution run.	unknown
Count	Total count of new items processed.	number
Typosquats	NRD domains identified as potential typosquats of monitored brand names.	unknown
FilteredCVEs	CVEs that passed the CVSS and tech-stack filters.	unknown
VIPCreated	Number of VIP-related incidents created during this execution.	number

Source

DarkmonFilterCVEs.py DarkmonFilterCVEs_test.py DarkmonFilterCVEs.yml

Download History Raw

commonfields:
  id: DarkmonFilterCVEs
  version: -1
name: DarkmonFilterCVEs
script: ""
type: python
subtype: python3
fromversion: 6.8.0
tags:
- darkmon
comment: "Filters CVEs by CVSS minimum and intersection with a tech-stack tag list."
args:
- name: items
  isArray: true
  description: Items to process.
- name: id_field
  description: Field name to use as the dedup key.
  defaultValue: id
- name: seen_list
  description: Name of the XSOAR List storing already-seen IDs.
- name: domain_filter_list
  description: Optional - list of customer domains to filter username matches.
- name: domain_match_field
  description: Field on each item to match against domain_filter_list.
  defaultValue: username
- name: allowlist
  description: Optional list of usernames/DNs that must NEVER be actioned.
- name: allowlist_match_field
  description: Field to match against the allowlist.
  defaultValue: username
- name: incident_type
  description: Incident type for newly created incidents.
- name: severity
  description: Severity (1=Low, 2=Medium, 3=High, 4=Critical).
- name: name_template
  description: Incident name template (supports ${field} interpolation).
- name: field_map
  description: Comma-separated 'fieldCli=sourcePath' pairs.
- name: emails
  isArray: true
  description: Email addresses to fan out per VIP fetch.
- name: domains
  isArray: true
  description: Optional list of customer domains to filter domain-based matches.
- name: brands_list
  description: Name of the XSOAR List containing brand names for NRD brand-watch matching.
- name: max_distance
  defaultValue: "2"
  description: Maximum Levenshtein distance allowed when matching NRD domains against brand names.
- name: min_cvss
  defaultValue: "9.0"
  description: Minimum CVSS score threshold; CVEs below this value are excluded.
- name: tech_stack_list
  description: Name of the XSOAR List containing tech-stack tags used to filter CVEs by relevance.
outputs:
- contextPath: NewAccounts
  description: Newly discovered account records that have not been previously actioned.
  type: unknown
- contextPath: CreatedIncidents
  description: Incidents created during this execution run.
  type: unknown
- contextPath: Count
  description: Total count of new items processed.
  type: number
- contextPath: Typosquats
  description: NRD domains identified as potential typosquats of monitored brand names.
  type: unknown
- contextPath: FilteredCVEs
  description: CVEs that passed the CVSS and tech-stack filters.
  type: unknown
- contextPath: VIPCreated
  description: Number of VIP-related incidents created during this execution.
  type: number
scripttarget: 0
runonce: false
dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- xsoar
- platform
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security