RiskSenseGetRansomewareCVEScript
This script is a helper script of Ransomware Exposure - RiskSense playbook and retrieve information of cves and trending cves from host finding details.
python · RiskSense
Details
| ID | RiskSenseGetRansomewareCVEScript |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Tags | RiskSense |
README
This script is a helper script for the Ransomware Exposure - RiskSense playbook and retrieves information of CVEs and trending CVEs from host finding details.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | RiskSense |
| Cortex XSOAR Version | 5.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| trending | Trending is defined by RiskSense as vulnerabilities that are being actively abused by attackers in the wild based on activity in hacker forums and Twitter feeds, as well as analysis of 3rd party threat intelligence sources. |
Outputs
| Path | Description | Type |
|---|---|---|
| RiskSense.RansomwareCves.Cve | The ID of the CVE. | String |
| RiskSense.RansomwareCves.CVSS | The CVSS score of the CVE. | Number |
| RiskSense.RansomwareCves.VRR | The risk rate of the host finding. | Number |
| RiskSense.RansomwareCves.ThreatCount | The total number of threats associated with the CVE. | Number |
| RiskSense.RansomwareCves.Trending | This signifies whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending. | boolean |
| RiskSense.RansomwareCves.VulnLastTrendingOn | Date when last trending vulnerability was found. | String |
| RiskSense.RansomwareCves.Description | A description of the CVE. | String |
| RiskSense.RansomwareCves.Threats.Title | The title of the threat. | String |
| RiskSense.RansomwareCves.Threats.Category | The threat category. | String |
| RiskSense.RansomwareCves.Threats.Severity | The severity level of the threat. | String |
| RiskSense.RansomwareCves.Threats.Description | The threat description. | String |
| RiskSense.RansomwareCves.Threats.Cve | List of CVEs that contain particular threat. | Unknown |
| RiskSense.RansomwareCves.Threats.Source | The source of the threat. | String |
| RiskSense.RansomwareCves.Threats.Published | The time when the threat was published. | String |
| RiskSense.RansomwareCves.Threats.Updated | The time when the threat was last updated. | String |
| RiskSense.RansomwareCves.Threats.ThreatLastTrendingOn | The last time when threat was in trending. | String |
| RiskSense.RansomwareCves.Threats.Trending | Whether the threat is trending. | boolean |
| RiskSense.RansomwareTrendingCves.Cve | The ID of the CVE. | String |
| RiskSense.RansomwareTrendingCves.CVSS | The CVSS score of the CVE. | Number |
| RiskSense.RansomwareTrendingCves.VRR | The risk rate of the host finding. | Number |
| RiskSense.RansomwareTrendingCves.ThreatCount | The total number of threats associated with the CVE. | Number |
| RiskSense.RansomwareTrendingCves.Trending | This signifies whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending. | boolean |
| RiskSense.RansomwareTrendingCves.VulnLastTrendingOn | Date when last trending vulnerability was found. | String |
| RiskSense.RansomwareTrendingCves.Description | A description of the CVE. | String |
| RiskSense.RansomwareTrendingCves.Threats.Title | The title of the threat. | String |
| RiskSense.RansomwareTrendingCves.Threats.Category | The threat category. | String |
| RiskSense.RansomwareTrendingCves.Threats.Severity | The severity level of the threat. | String |
| RiskSense.RansomwareTrendingCves.Threats.Description | The threat description. | String |
| RiskSense.RansomwareTrendingCves.Threats.Cve | List of CVEs that contain particular threat. | Unknown |
| RiskSense.RansomwareTrendingCves.Threats.Source | The source of the threat. | String |
| RiskSense.RansomwareTrendingCves.Threats.Published | The time when the threat was published. | String |
| RiskSense.RansomwareTrendingCves.Threats.Updated | The time when the threat was last updated. | String |
| RiskSense.RansomwareTrendingCves.Threats.ThreatLastTrendingOn | The last time when threat was in trending. | String |
| RiskSense.RansomwareTrendingCves.Threats.Trending | Whether the threat is trending. | boolean |
| Date.CurrentDate | The current date | String |
| Date.WeekAgoDate | The date that was 7 days ago starting from current date. | String |
| CVECount | The count of the CVEs. | Number |
| TrendingCVECount | The count of the trending CVEs. | Number |
args: - defaultValue: 'False' description: Trending is defined by RiskSense as vulnerabilities that are being actively abused by attackers in the wild based on activity in hacker forums, Twitter feeds as well as analysis of 3rd party threat intelligence sources. name: trending required: true comment: This script is a helper script of Ransomware Exposure - RiskSense playbook and retrieve information of cves and trending cves from host finding details. commonfields: id: RiskSenseGetRansomewareCVEScript version: -1 name: RiskSenseGetRansomewareCVEScript outputs: - contextPath: RiskSense.RansomwareCves.Cve description: The ID of the CVE. type: String - contextPath: RiskSense.RansomwareCves.CVSS description: The CVSS score of the CVE. type: Number - contextPath: RiskSense.RansomwareCves.VRR description: The risk rate of the host finding. type: Number - contextPath: RiskSense.RansomwareCves.ThreatCount description: The total number of threats associated with the CVE. type: Number - contextPath: RiskSense.RansomwareCves.Trending description: This signifies whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending. type: boolean - contextPath: RiskSense.RansomwareCves.VulnLastTrendingOn description: Date when last trending vulnerability was found. type: String - contextPath: RiskSense.RansomwareCves.Description description: A description of the CVE. type: String - contextPath: RiskSense.RansomwareCves.Threats.Title description: The title of the threat. type: String - contextPath: RiskSense.RansomwareCves.Threats.Category description: The threat category. type: String - contextPath: RiskSense.RansomwareCves.Threats.Severity description: The severity level of the threat. type: String - contextPath: RiskSense.RansomwareCves.Threats.Description description: The threat description. type: String - contextPath: RiskSense.RansomwareCves.Threats.Cve description: List of CVEs that contain particular threat. type: Unknown - contextPath: RiskSense.RansomwareCves.Threats.Source description: The source of the threat. type: String - contextPath: RiskSense.RansomwareCves.Threats.Published description: The time when the threat was published. type: String - contextPath: RiskSense.RansomwareCves.Threats.Updated description: The time when the threat was last updated. type: String - contextPath: RiskSense.RansomwareCves.Threats.ThreatLastTrendingOn description: The last time when threat was in trending. type: String - contextPath: RiskSense.RansomwareCves.Threats.Trending description: Whether the threat is trending. type: boolean - contextPath: RiskSense.RansomwareTrendingCves.Cve description: The ID of the CVE. type: String - contextPath: RiskSense.RansomwareTrendingCves.CVSS description: The CVSS score of the CVE. type: Number - contextPath: RiskSense.RansomwareTrendingCves.VRR description: The risk rate of the host finding. type: Number - contextPath: RiskSense.RansomwareTrendingCves.ThreatCount description: The total number of threats associated with the CVE. type: Number - contextPath: RiskSense.RansomwareTrendingCves.Trending description: This signifies whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending. type: boolean - contextPath: RiskSense.RansomwareTrendingCves.VulnLastTrendingOn description: Date when last trending vulnerability was found. type: String - contextPath: RiskSense.RansomwareTrendingCves.Description description: A description of the CVE. type: String - contextPath: RiskSense.RansomwareTrendingCves.Threats.Title description: The title of the threat. type: String - contextPath: RiskSense.RansomwareTrendingCves.Threats.Category description: The threat category. type: String - contextPath: RiskSense.RansomwareTrendingCves.Threats.Severity description: The severity level of the threat. type: String - contextPath: RiskSense.RansomwareTrendingCves.Threats.Description description: The threat description. type: String - contextPath: RiskSense.RansomwareTrendingCves.Threats.Cve description: List of CVEs that contain particular threat. type: Unknown - contextPath: RiskSense.RansomwareTrendingCves.Threats.Source description: The source of the threat. type: String - contextPath: RiskSense.RansomwareTrendingCves.Threats.Published description: The time when the threat was published. type: String - contextPath: RiskSense.RansomwareTrendingCves.Threats.Updated description: The time when the threat was last updated. type: String - contextPath: RiskSense.RansomwareTrendingCves.Threats.ThreatLastTrendingOn description: The last time when threat was in trending. type: String - contextPath: RiskSense.RansomwareTrendingCves.Threats.Trending description: Whether the threat is trending. type: boolean - contextPath: Date.CurrentDate description: The current date. type: String - contextPath: Date.WeekAgoDate description: The date that was 7 days ago starting from current date. type: String - contextPath: CVECount description: The count of the CVEs. type: Number - contextPath: TrendingCVECount description: The count of the trending CVEs. type: Number script: '-' subtype: python3 tags: - RiskSense timeout: '0' type: python dependson: must: - '|||risksense-get-host-findings' dockerimage: demisto/python3:3.12.13.10116658 tests: - No tests (auto formatted) fromversion: 5.0.0