RiskSenseGetRansomewareCVEScript

Details

ID	`RiskSenseGetRansomewareCVEScript`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	RiskSense

README

This script is a helper script for the Ransomware Exposure - RiskSense playbook and retrieves information of CVEs and trending CVEs from host finding details.

Script Data

Name	Description
Script Type	python3
Tags	RiskSense
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
trending	Trending is defined by RiskSense as vulnerabilities that are being actively abused by attackers in the wild based on activity in hacker forums and Twitter feeds, as well as analysis of 3rd party threat intelligence sources.

Outputs

Path	Description	Type
RiskSense.RansomwareCves.Cve	The ID of the CVE.	String
RiskSense.RansomwareCves.CVSS	The CVSS score of the CVE.	Number
RiskSense.RansomwareCves.VRR	The risk rate of the host finding.	Number
RiskSense.RansomwareCves.ThreatCount	The total number of threats associated with the CVE.	Number
RiskSense.RansomwareCves.Trending	This signifies whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending.	boolean
RiskSense.RansomwareCves.VulnLastTrendingOn	Date when last trending vulnerability was found.	String
RiskSense.RansomwareCves.Description	A description of the CVE.	String
RiskSense.RansomwareCves.Threats.Title	The title of the threat.	String
RiskSense.RansomwareCves.Threats.Category	The threat category.	String
RiskSense.RansomwareCves.Threats.Severity	The severity level of the threat.	String
RiskSense.RansomwareCves.Threats.Description	The threat description.	String
RiskSense.RansomwareCves.Threats.Cve	List of CVEs that contain particular threat.	Unknown
RiskSense.RansomwareCves.Threats.Source	The source of the threat.	String
RiskSense.RansomwareCves.Threats.Published	The time when the threat was published.	String
RiskSense.RansomwareCves.Threats.Updated	The time when the threat was last updated.	String
RiskSense.RansomwareCves.Threats.ThreatLastTrendingOn	The last time when threat was in trending.	String
RiskSense.RansomwareCves.Threats.Trending	Whether the threat is trending.	boolean
RiskSense.RansomwareTrendingCves.Cve	The ID of the CVE.	String
RiskSense.RansomwareTrendingCves.CVSS	The CVSS score of the CVE.	Number
RiskSense.RansomwareTrendingCves.VRR	The risk rate of the host finding.	Number
RiskSense.RansomwareTrendingCves.ThreatCount	The total number of threats associated with the CVE.	Number
RiskSense.RansomwareTrendingCves.Trending	This signifies whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending.	boolean
RiskSense.RansomwareTrendingCves.VulnLastTrendingOn	Date when last trending vulnerability was found.	String
RiskSense.RansomwareTrendingCves.Description	A description of the CVE.	String
RiskSense.RansomwareTrendingCves.Threats.Title	The title of the threat.	String
RiskSense.RansomwareTrendingCves.Threats.Category	The threat category.	String
RiskSense.RansomwareTrendingCves.Threats.Severity	The severity level of the threat.	String
RiskSense.RansomwareTrendingCves.Threats.Description	The threat description.	String
RiskSense.RansomwareTrendingCves.Threats.Cve	List of CVEs that contain particular threat.	Unknown
RiskSense.RansomwareTrendingCves.Threats.Source	The source of the threat.	String
RiskSense.RansomwareTrendingCves.Threats.Published	The time when the threat was published.	String
RiskSense.RansomwareTrendingCves.Threats.Updated	The time when the threat was last updated.	String
RiskSense.RansomwareTrendingCves.Threats.ThreatLastTrendingOn	The last time when threat was in trending.	String
RiskSense.RansomwareTrendingCves.Threats.Trending	Whether the threat is trending.	boolean
Date.CurrentDate	The current date	String
Date.WeekAgoDate	The date that was 7 days ago starting from current date.	String
CVECount	The count of the CVEs.	Number
TrendingCVECount	The count of the trending CVEs.	Number

Source

RiskSenseGetRansomewareCVEScript.py RiskSenseGetRansomewareCVEScript_test.py RiskSenseGetRansomewareCVEScript.yml

Download History Raw

EXPECTED_RANSOMWARE_CVES = [
    {
        "Cve": "CVE-0000-0000",
        "CVSS": 7.5,
        "VRR": 5.67,
        "ThreatCount": 1,
        "Trending": "false",
        "VulnLastTrendingOn": "2018-05-01",
        "Description": "remote code execution",
        "Threats": [
            {
                "Title": "Hunter Exploit Kit",
                "Category": "Ransomware",
                "Severity": "null",
                "Description": "",
                "Cve": ["CVE-0000-0000"],
                "Source": "MCAFEE",
                "Published": "2017-08-03T00:00:00",
                "Updated": "2019-08-16T15:50:04",
                "ThreatLastTrendingOn": "2018-02-23",
                "Trending": "false",
            }
        ],
    }
]

HOST_FINDING_DATA = [
    {
        "HostID": 3569982,
        "Vulnerability": [
            {
                "Cve": "CVE-0000-0000",
                "BaseScore": 7.5,
                "ThreatCount": 0,
                "AttackVector": "Network",
                "AccessComplexity": "Low",
                "Authentication": "None",
                "ConfidentialityImpact": "Partial",
                "Integrity": "Partial",
                "AvailabilityImpact": "Partial",
                "Trending": "false",
                "VulnLastTrendingOn": "2018-05-01",
                "Description": "remote code execution",
            }
        ],
        "ThreatCount": 0,
        "Threat": [
            {
                "Title": "Hunter Exploit Kit",
                "Category": "Ransomware",
                "Severity": "null",
                "Description": "",
                "Details": "",
                "Cve": ["CVE-0000-0000"],
                "Source": "MCAFEE",
                "Published": "2017-08-03T00:00:00",
                "Updated": "2019-08-16T15:50:04",
                "ThreatLastTrendingOn": "2018-02-23",
                "Trending": "false",
                "Link": "",
            }
        ],
        "RiskRating": 5.67,
    }
]


def test_header_transform():
    from RiskSenseGetRansomewareCVEScript import header_transform

    assert header_transform("CVSS") == "CVSS Score"
    assert header_transform("VRR") == "VRR Score"
    assert header_transform("ThreatCount") == "Threat Count"
    assert header_transform("VulnLastTrendingOn") == "Last Trending On Date"
    assert header_transform("Trending") == "Trending"


def test_get_ransomware_cves():
    from RiskSenseGetRansomewareCVEScript import get_ransomware_cves

    ransomware_cves = get_ransomware_cves(HOST_FINDING_DATA)
    assert ransomware_cves == EXPECTED_RANSOMWARE_CVES


def test_display_ransomware_trending_cve_results():
    from RiskSenseGetRansomewareCVEScript import display_ransomware_trending_cve_results

    result = display_ransomware_trending_cve_results(EXPECTED_RANSOMWARE_CVES)

    assert result.outputs_prefix == "RiskSense.RansomwareTrendingCves"
    assert result.outputs_key_field == "Cve"


def test_display_ransomware_cve_results():
    from RiskSenseGetRansomewareCVEScript import display_ransomware_cve_results

    result = display_ransomware_cve_results(EXPECTED_RANSOMWARE_CVES)

    assert result.outputs_prefix == "RiskSense.RansomwareCves"
    assert result.outputs_key_field == "Cve"
    assert result.outputs == EXPECTED_RANSOMWARE_CVES