commonfields: id: RiskSense version: -1 name: RiskSense display: RiskSense category: Vulnerability Management provider: Ivanti description: RiskSense is a cloud-based platform that provides vulnerability management and prioritization to measure and control cybersecurity risk. configuration: - display: URL name: url defaultvalue: https://platform.risksense.com type: 0 required: true - display: API Key name: api_key defaultvalue: "" type: 4 required: true - display: Client Name name: client_name defaultvalue: "" type: 0 required: true - display: HTTP Request Timeout (Specify the time interval in seconds. All the RiskSense API calls would timeout if the response is not returned within the configured time interval). name: request_timeout defaultvalue: 60 type: 0 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false script: script: '' commands: - name: risksense-get-hosts arguments: - name: fieldname auto: PREDEFINED predefined: - Host Name - IP Address - Criticality description: The RiskSense host attribute by which to filter the results. Can be 'Host Name', 'IP Address', or 'Criticality'. Apart from the available choices, you can provide the attributes supported by RiskSense API. Refer to the API /host/filter API to get the list of supported attributes. The uid of filter attributes must be provided here, for example, assessment_labels, asset_tags, cvss3BaseI, etc. If specified, 'value' argument is mandatory. - name: operator auto: PREDEFINED predefined: - EXACT - IN - LIKE - BETWEEN description: The match operator should be applied for filtering the hosts based on 'fieldname' and 'value'. Can be 'EXACT' - filter records exactly matching the criteria; 'IN' - filter records matching any one of the comma-separated values; 'LIKE' - filter records with the value matching the specified pattern. All the records fieldname value contains the string provided in value; 'BETWEEN' - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. - name: exclude auto: PREDEFINED predefined: - 'true' - 'false' description: The exclude flag that determines whether the returned records matches filter criteria or not. The default set is false. If set to True, host not matching the specified values are fetched. - name: value description: The value of the host property mentioned in 'fieldname' to be considered for filter criteria. isArray: true - name: page description: The index of the page. The index is a numeric value starting with 0. defaultValue: 0 - name: size description: The maximum number of records to fetch in one page. defaultValue: 10 - name: sort_by auto: PREDEFINED predefined: - Total Findings - Critical Findings - High Findings - Medium Findings - Low Findings - Info Findings - RS3 description: The fieldname by which to sort the returned records. defaultValue: RS3 - name: sort_direction auto: PREDEFINED predefined: - Ascending - Descending description: The sorting direction to apply to returned records. defaultValue: Ascending outputs: - contextPath: Host.Hostname description: The hostname of the host. type: String - contextPath: Host.ID description: The unique ID within the tool retrieving the host. type: String - contextPath: Host.IP description: The IP address of the host. type: String - contextPath: Host.OS description: The operating system of the host. type: String - contextPath: RiskSense.Host.ID description: The unique identifier of the host. type: Number - contextPath: RiskSense.Host.ClientID description: The client id of the host. type: Number - contextPath: RiskSense.Host.GroupID description: The ID of the group belonging to the host. type: Number - contextPath: RiskSense.Host.GroupName description: The name of the group belonging to the host. type: String - contextPath: RiskSense.Host.Group.ID description: The ID of the group belonging to the host. type: Number - contextPath: RiskSense.Host.Group.Name description: The name of the group belonging to the host. type: String - contextPath: RiskSense.Host.Rs3 description: The asset security score calculated by the RiskSense platform (includes vulnerability risk on related web applications). type: Number - contextPath: RiskSense.Host.Xrs3 description: The asset security score calculated by the RiskSense platform (includes vulnerability risk on related web applications). type: String - contextPath: RiskSense.Host.Criticality description: The asset importance using a scale of 1 (lowest importance) to 5 (highest importance). type: Number - contextPath: RiskSense.Host.Tag.ID description: The ID of the tag. type: Number - contextPath: RiskSense.Host.Tag.Name description: The name of the tag. type: String - contextPath: RiskSense.Host.Tag.Category description: The category of the tag. type: String - contextPath: RiskSense.Host.Tag.Description description: The description of the tag. type: String - contextPath: RiskSense.Host.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.Host.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.Host.Tag.Color description: The color code of the tag. type: String - contextPath: RiskSense.Host.NetworkID description: The Network ID of the host. type: Number - contextPath: RiskSense.Host.NetworkName description: The name of the network used by the host. type: String - contextPath: RiskSense.Host.NetworkType description: The type of the network used by the host. type: String - contextPath: RiskSense.Host.DiscoveredOn description: The time when the host was discovered. type: String - contextPath: RiskSense.Host.LastFoundOn description: The time when the host was last found. type: String - contextPath: RiskSense.Host.LastScanTime description: The last time when the host was last scanned. type: String - contextPath: RiskSense.Host.HostName description: The hostname of the host. type: String - contextPath: RiskSense.Host.IpAddress description: The IP address of the host. type: String - contextPath: RiskSense.Host.PortNumbers description: The list of ports that are currently bound. type: String - contextPath: RiskSense.Host.OS.Name description: The operating system of the host. type: String - contextPath: RiskSense.Host.OS.Family description: The family of the operating system of the host. type: String - contextPath: RiskSense.Host.OS.Class description: The class of the operating system of the host. type: String - contextPath: RiskSense.Host.OS.Vendor description: The vendor information of the operating system of the host. type: String - contextPath: RiskSense.Host.CMDB.Order description: The CMDB order number of the host. type: Number - contextPath: RiskSense.Host.CMDB.Key description: The CMDB key identifier of the host. type: String - contextPath: RiskSense.Host.CMDB.Value description: The CMDB value identifier of the host. type: String - contextPath: RiskSense.Host.CMDB.Label description: The CMDB label identifier of the host. type: String - contextPath: RiskSense.Host.Services description: The name of the services which are used by the host. type: String - contextPath: RiskSense.Host.Note.UserID description: The User ID of the user who added a note for the host. type: String - contextPath: RiskSense.Host.Note.UserName description: The username of the user who added a note for the host. type: String - contextPath: RiskSense.Host.Note.Note description: The notes that are added by the user for the host. type: String - contextPath: RiskSense.Host.Note.Date description: The time when the note was added by the user for the host. type: String - contextPath: RiskSense.Host.Source.Name description: The name of the source associated with the host. type: String - contextPath: RiskSense.Host.Source.UuID description: The unique ID of the source associated with the host. type: String - contextPath: RiskSense.Host.Source.ScannerType description: The type of scanner that discovered the host. type: String - contextPath: RiskSense.Host.Ticket.TicketNumber description: The number of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.TicketStatus description: The status of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.DeepLink description: The deeplink associated with the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.Type description: The type of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.ConnectorName description: The connector name of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.DetailedStatus description: The detailed status of the ticket associated with the host. type: String - contextPath: RiskSense.Host.LastVulnTrendingOn description: The time when the last vulnerability was trending on the host. type: String - contextPath: RiskSense.Host.LastThreatTrendingOn description: The time when the last threat was trending on the host. type: String - contextPath: RiskSense.Host.OldestOpenFindingWithThreatDiscoveredOn description: The timestamp when the oldest open finding with the threat was discovered. type: String - contextPath: RiskSense.Host.Xrs3date description: The time when the xrs3 is calculated by RiskSense platform. type: String - contextPath: RiskSense.Host.DiscoveredByRS description: The flag that determines whether the host is discovered by the RiskSense platform or not. type: String - contextPath: RiskSense.Host.Href description: The deeplink pointing to the host details on RiskSense. type: String - contextPath: RiskSense.Host.Total description: The number of total open findings of the host. type: Number - contextPath: RiskSense.Host.Critical description: The number of open findings of the host with critical severity. type: Number - contextPath: RiskSense.Host.High description: The number of open findings of the host with high severity. type: Number - contextPath: RiskSense.Host.Medium description: The number of open findings of the host with medium severity. type: Number - contextPath: RiskSense.Host.Low description: The number of open findings of the host with low severity. type: Number - contextPath: RiskSense.Host.Info description: The number of open findings of the host with info severity. type: Number - contextPath: Ticket.ID description: The ID of the ticket associated with the host. type: String - contextPath: Ticket.State description: The state of the ticket associated with the host. type: String description: Gets details of the supplied host. The host details can be searched based on input parameters like fieldname (Host Name, IP Address, Criticality, etc), operator (EXACT, IN, LIKE, BETWEEN), page, size, sort by and sort direction. - name: risksense-get-host-detail arguments: - name: host_id description: The unique host ID of the host. The host ID is either known by RiskSense users or it can be searched in context output (RiskSense.Host.ID) or in the human-readable output of 'risksense-get-hosts' command. - name: host description: The hostname of the host. The hostname is either known by RiskSense users or it can be searched in context output (RiskSense.Host.HostName) or in the human-readable output of 'risksense-get-hosts' command. outputs: - contextPath: Host.Hostname description: The hostname of the host. type: String - contextPath: Host.ID description: The unique ID within the tool retrieving the host. type: String - contextPath: Host.IP description: The IP address of the host. type: String - contextPath: Host.OS description: The operating system of the host. type: String - contextPath: RiskSense.Host.ID description: The unique identifier of the host. type: Number - contextPath: RiskSense.Host.ClientID description: The client ID of the host. type: Number - contextPath: RiskSense.Host.GroupID description: The ID of the group belonging to the host. type: Number - contextPath: RiskSense.Host.GroupName description: The name of the group belonging to the host. type: String - contextPath: RiskSense.Host.Group.ID description: The ID of the group belonging to the host. type: Number - contextPath: RiskSense.Host.Group.Name description: The name of the group belonging to the host. type: String - contextPath: RiskSense.Host.Rs3 description: The asset security score calculated by the RiskSense platform (includes vulnerability risk on related web applications). type: Number - contextPath: RiskSense.Host.Xrs3 description: The asset security score calculated by RiskSense platform. type: String - contextPath: RiskSense.Host.Criticality description: The asset importance using a scale of 1 (lowest importance) to 5 (highest importance). type: Number - contextPath: RiskSense.Host.Tag.ID description: The ID of the tag. type: Number - contextPath: RiskSense.Host.Tag.Name description: The name of the tag. type: String - contextPath: RiskSense.Host.Tag.Category description: The category of the tag. type: String - contextPath: RiskSense.Host.Tag.Description description: The description of the tag. type: String - contextPath: RiskSense.Host.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.Host.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.Host.Tag.Color description: The color code of the tag. type: String - contextPath: RiskSense.Host.NetworkID description: The network ID of the host. type: Number - contextPath: RiskSense.Host.NetworkName description: The name of the network used by the host. type: String - contextPath: RiskSense.Host.NetworkType description: The type of the network used by the host. type: String - contextPath: RiskSense.Host.DiscoveredOn description: The time when the host was discovered. type: String - contextPath: RiskSense.Host.LastFoundOn description: The time when the host was last found. type: String - contextPath: RiskSense.Host.LastScanTime description: The last time when the host was last scanned. type: String - contextPath: RiskSense.Host.HostName description: The hostname of the host. type: String - contextPath: RiskSense.Host.IpAddress description: The IP address of the host. type: String - contextPath: RiskSense.Host.PortNumbers description: The list of ports that are currently bound. type: String - contextPath: RiskSense.Host.OS.Name description: The operating system of the host. type: String - contextPath: RiskSense.Host.OS.Family description: The family of the operating system of the host. type: String - contextPath: RiskSense.Host.OS.Class description: The class of the operating system of the host. type: String - contextPath: RiskSense.Host.OS.Vendor description: The vendor information of the operating system of the host. type: String - contextPath: RiskSense.Host.CMDB.Order description: The CMDB order number of the host. type: Number - contextPath: RiskSense.Host.CMDB.Key description: The CMDB key identifier of the host. type: String - contextPath: RiskSense.Host.CMDB.Value description: The CMDB value identifier of the host. type: String - contextPath: RiskSense.Host.CMDB.Label description: The CMDB label identifier of the host. type: String - contextPath: RiskSense.Host.Services description: The name of the services which are used by the host. type: String - contextPath: RiskSense.Host.Note.UserID description: The User ID of the user who added a note for the host. type: String - contextPath: RiskSense.Host.Note.UserName description: The username of the user who added a note for the host. type: String - contextPath: RiskSense.Host.Note.Note description: The notes that are added by the user for the host. type: String - contextPath: RiskSense.Host.Note.Date description: The time when the note was added by the user for the host. type: String - contextPath: RiskSense.Host.Source.Name description: The name of the source associated with the host. type: String - contextPath: RiskSense.Host.Source.UuID description: The unique ID of the source associated with the host. type: String - contextPath: RiskSense.Host.Source.ScannerType description: The type of scanner that discovered the host. type: String - contextPath: RiskSense.Host.Ticket.TicketNumber description: The number of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.TicketStatus description: The status of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.DeepLink description: The deeplink of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.Type description: The type of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.ConnectorName description: The connector name of the ticket associated with the host. type: String - contextPath: RiskSense.Host.Ticket.DetailedStatus description: The detailed status of the ticket associated with the host. type: String - contextPath: RiskSense.Host.LastVulnTrendingOn description: The time when the last vulnerability was trending on the host. type: String - contextPath: RiskSense.Host.LastThreatTrendingOn description: The time when the last threat was trending on the host. type: String - contextPath: RiskSense.Host.OldestOpenFindingWithThreatDiscoveredOn description: The timestamp when the oldest open finding with the threat was discovered. type: String - contextPath: RiskSense.Host.Xrs3date description: The time when the xrs3 is calculated by RiskSense platform. type: String - contextPath: RiskSense.Host.DiscoveredByRS description: The flag that determines whether the host is discovered by the RiskSense platform or not. type: String - contextPath: RiskSense.Host.Href description: The deeplink pointing to the host details on RiskSense. type: String - contextPath: RiskSense.Host.Total description: The number of total open findings of the host. type: Number - contextPath: RiskSense.Host.Critical description: The number of open findings of the host with critical severity. type: Number - contextPath: RiskSense.Host.High description: The number of open findings of the host with high severity. type: Number - contextPath: RiskSense.Host.Medium description: The number of open findings of the host with medium severity. type: Number - contextPath: RiskSense.Host.Low description: The number of open findings of the host with low severity. type: Number - contextPath: RiskSense.Host.Info description: The number of open findings of the host with info severity. type: Number - contextPath: Ticket.ID description: The ID of the ticket associated with the host. type: String - contextPath: Ticket.State description: The state of the ticket associated with the host. type: String description: Gets in-depth details of a single host. This command accepts either hostname or host ID as an argument. - name: risksense-get-unique-cves arguments: - name: hostFindingId required: true description: The unique host finding ID. The host finding ID is either known by RiskSense users or it can be found in the human-readable output or context data(RiskSense.HostFinding.ID) after executing 'risksense-get-host-findings' command. outputs: - contextPath: RiskSense.UniqueVulnerabilities.Cve description: Common Vulnerabilities and Exposures name. type: String - contextPath: RiskSense.UniqueVulnerabilities.HostFindingID description: The unique ID of the host finding. type: String - contextPath: RiskSense.UniqueVulnerabilities.BaseScore description: The base score represents the severity of the risk (informational, low, medium, high, or critical). - contextPath: RiskSense.UniqueVulnerabilities.ThreatCount description: Total number of threats found. type: Number - contextPath: RiskSense.UniqueVulnerabilities.AttackVector description: The attack vectors are a path by which attackers can gain access to the network. type: String - contextPath: RiskSense.UniqueVulnerabilities.AccessComplexity description: The access complexity describes conditions that are beyond the attacker's control that must exist in order to exploit the vulnerability. type: String - contextPath: RiskSense.UniqueVulnerabilities.Authentication description: The authentication value represents attackers authorization to get network access. type: String - contextPath: RiskSense.UniqueVulnerabilities.ConfidentialityImpact description: The confidentiality impact measures the potential impact on confidentiality of a successfully exploited misuse vulnerability. type: String - contextPath: RiskSense.UniqueVulnerabilities.Integrity description: The Integrity refers to the trust level and veracity of the information. type: String - contextPath: RiskSense.UniqueVulnerabilities.AvailabilityImpact description: The availability refers to accessibility of network resources. type: String - contextPath: RiskSense.UniqueVulnerabilities.Trending description: Trending is defined by RiskSense as vulnerabilities that are being actively abused by attackers in the wild based on activity in hacker forums, Twitter feeds, and analysis of 3rd party threat intelligence sources. type: Boolean - contextPath: RiskSense.UniqueVulnerabilities.VulnLastTrendingOn description: The last trending date of vulnerability. type: String - contextPath: CVE.ID description: Common Vulnerabilities and Exposures ID. type: String - contextPath: CVE.Description description: Description about CVE. type: String - contextPath: CVE.CVSS description: The CVSS represents the severity of the risk (informational, low, medium, high, critical). type: String description: Looks up vulnerability details for the supplied host finding with its base score. - name: risksense-get-unique-open-findings arguments: - name: fieldname auto: PREDEFINED predefined: - Title - Severity - Source description: The RiskSense host finding attribute that should be considered for filtering the results. The available choices are 'Title', 'Severity', and 'Source'. Apart from the available choices, one can provide the attributes supported by RiskSense API. Refer to the API /uniqueHostFinding/filter API to get the list of supported attributes. The uid of filter attributes must be provided here. e.g. assessment_labels, asset_tags, cvss3BaseI, etc. If specified, 'value' argument is mandatory. - name: operator auto: PREDEFINED predefined: - EXACT - IN - LIKE - BETWEEN description: The match operator should be applied for filtering the hosts based on 'fieldname' and 'value'. Available options are 'EXACT' - filter records exactly matching the criteria; 'IN' - filter records matching any one of the comma-separated values; 'LIKE' - filter records with the value matching the specified pattern. All the records fieldname value contains the string provided in value; 'BETWEEN' - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. - name: value description: The value of the unique open finding property mentioned in 'fieldname' to be considered for filter criteria. isArray: true - name: exclude auto: PREDEFINED predefined: - 'true' - 'false' description: The exclude flag that determines whether the returned records matches filter criteria or not. By default set to False. - name: page description: The index of the page. The index is a numeric value and starting with 0. defaultValue: 0 - name: size description: The maximum number of records to fetch in one page. defaultValue: 10 - name: sort_by auto: PREDEFINED predefined: - Title - Severity - Source - ID description: The fieldname that should be considered for sorting the returned records. defaultValue: severity - name: sort_direction auto: PREDEFINED predefined: - Ascending - Descending description: The sorting direction to apply to returned records. defaultValue: Ascending outputs: - contextPath: RiskSense.UniqueHostFinding.Title description: The title of the unique host finding. type: String - contextPath: RiskSense.UniqueHostFinding.Severity description: Similar to risk rating, the severity of a vulnerability conveys the potential threat. type: Number - contextPath: RiskSense.UniqueHostFinding.HostCount description: The total number of hosts found in unique host finding. type: Number - contextPath: RiskSense.UniqueHostFinding.Source description: The name of the source associated with the unique host finding. type: String - contextPath: RiskSense.UniqueHostFinding.SourceID description: The unique ID of the source. type: String - contextPath: RiskSense.UniqueHostFinding.Href description: Reference API link of the unique host finding search. type: String description: Finds unique open host findings.The open findings can be searched based on input parameters like fieldname (Severity, Title, Source etc), operator (EXACT, IN, LIKE, BETWEEN), page and size. - name: risksense-get-host-findings description: A detailed host finding view with the severity level. Displays vulnerability information like CVE, Threats associated with current findings and origin of findings. arguments: - name: fieldname auto: PREDEFINED predefined: - Title - IP Address - Host Name description: The RiskSense host finding attribute that should be considered for filtering the results. The available choices are 'Title', 'IP Address', or 'Host Name'. In addition to the available choices, you can provide the attributes supported by RiskSense API. Refer to the API /hostFinding/filter API to get the list of supported attributes. The uid of filter attributes must be provided here. e.g. assessment_labels, asset_tags, cvss3BaseI, etc. If specified, 'value' argument is mandatory. - name: operator auto: PREDEFINED predefined: - EXACT - IN - LIKE - BETWEEN description: The match operator should be applied for filtering the hosts based on 'fieldname' and 'value'. Available options are 'EXACT' (filter records exactly matching the criteria), 'IN' (filter records matching any one of the comma-separated values), or 'LIKE' (filter records with the value matching the specified pattern). All the records fieldname value contains the string provided in value; 'BETWEEN' - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. - name: exclude auto: PREDEFINED predefined: - 'true' - 'false' description: The exclude flag that determines whether the returned records matches filter criteria or not. By default set to False. - name: value description: The value of the 'fieldname' to be considered for filter criteria. isArray: true - name: page description: The index of the page. The index is numeric value starting with 0. defaultValue: 0 - name: size description: The maximum number of records to fetch in one page. defaultValue: 10 - name: sort_by auto: PREDEFINED predefined: - Risk Rating - Severity description: The fieldname that should be considered for sorting the returned records. defaultValue: Risk Rating - name: sort_direction auto: PREDEFINED predefined: - Ascending - Descending description: The sorting direction to apply to returned records. defaultValue: Ascending - name: status auto: PREDEFINED predefined: - Open - Closed description: The status of the host findings to be considered for returned records. outputs: - contextPath: RiskSense.HostFinding.ID description: The unique ID of the host finding. type: String - contextPath: RiskSense.HostFinding.Source description: Host discovered by the scanner. type: String - contextPath: RiskSense.HostFinding.SourceID description: Scanner ID of discovered scanner. type: String - contextPath: RiskSense.HostFinding.Title description: The title of the host finding. type: String - contextPath: RiskSense.HostFinding.Port description: The port number of the host finding. type: Number - contextPath: RiskSense.HostFinding.GroupCount description: The total number of groups for host finding. type: Number - contextPath: RiskSense.HostFinding.GroupID description: The unique ID of the group associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.GroupName description: The name of the group associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Group.ID description: The unique ID of the group associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Group.Name description: The name of the group associated with the host finding. type: String - contextPath: RiskSense.HostFinding.HostID description: The unique ID of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.HostName description: The hostname of the host associated with the host finding. type: String - contextPath: RiskSense.HostFinding.HostIpAddress description: The IP address of the host associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Host.Criticality description: The criticality of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.External description: Whether the identify of the host is external or internal. type: boolean - contextPath: RiskSense.HostFinding.Host.Port.ID description: The unique ID of the host(s) port associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.Port.Number description: The port number of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.Rs3 description: The Asset Security Score calculated by the RiskSense platform (includes vulnerability risk on related web applications). type: Number - contextPath: RiskSense.HostFinding.Network.ID description: The network ID of the host finding. type: Number - contextPath: RiskSense.HostFinding.Network.Name description: The name of the network used by the host finding. type: String - contextPath: RiskSense.HostFinding.Network.Type description: The type of the network used by the host finding. type: String - contextPath: RiskSense.HostFinding.Assessment.ID description: The assessment ID of the host finding. type: Number - contextPath: RiskSense.HostFinding.Assessment.Name description: The name of the assessment associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Assessment.Date description: The time when the assessment is created. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Cve description: The name of the Common Vulnerabilities and Exposures associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Vulnerability.BaseScore description: CVE Score. type: Number - contextPath: RiskSense.HostFinding.Vulnerability.ThreatCount description: The total number of threats associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Vulnerability.AttackVector description: Vector information in which the host was attacked. type: String - contextPath: RiskSense.HostFinding.Vulnerability.AccessComplexity description: Complexity level. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Authentication description: Authentication value represents attackers authorization to get network access. type: String - contextPath: RiskSense.HostFinding.Vulnerability.ConfidentialityImpact description: Confidentiality impact measures the potential impact on confidentiality of a successfully exploited misuse vulnerability. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Integrity description: Integrity refers to the trustworthiness and veracity of information. type: String - contextPath: RiskSense.HostFinding.Vulnerability.AvailabilityImpact description: Availability refers to accessibility of network resources. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Trending description: This signifies whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending. type: boolean - contextPath: RiskSense.HostFinding.Vulnerability.VulnLastTrendingOn description: Date when last trending vulnerability was found. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Description description: A description of the CVE. type: String - contextPath: RiskSense.HostFinding.ThreatCount description: The total number of threats. type: Number - contextPath: RiskSense.HostFinding.Threat.Title description: The title of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Category description: The threat category. type: String - contextPath: RiskSense.HostFinding.Threat.Severity description: The severity level of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Description description: The threat description. type: String - contextPath: RiskSense.HostFinding.Threat.Cve description: The Common Vulnerabilities and Exposures name of the threat. - contextPath: RiskSense.HostFinding.Threat.Source description: The source of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Published description: The time when the threat was published. type: String - contextPath: RiskSense.HostFinding.Threat.Updated description: The time when the threat was last updated. type: String - contextPath: RiskSense.HostFinding.Threat.ThreatLastTrendingOn description: The last time when threat was in trending. type: String - contextPath: RiskSense.HostFinding.Threat.Trending description: Whether the threat is trending. type: boolean - contextPath: RiskSense.HostFinding.Patch.Name description: The patch name of the host finding. type: String - contextPath: RiskSense.HostFinding.Patch.Url description: The patch URL of the host finding. type: String - contextPath: RiskSense.HostFinding.TagCount description: The total number of tags associated with host finding. type: Number - contextPath: RiskSense.HostFinding.Tag.ID description: The tag identifier of the host finding. type: Number - contextPath: RiskSense.HostFinding.Tag.Name description: The tag name of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Category description: The tag category of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Description description: The tag description of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.HostFinding.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.HostFinding.Tag.Color description: The color of the tag. type: String - contextPath: RiskSense.HostFinding.TagAssetCount description: The total number of tag assets. type: Number - contextPath: RiskSense.HostFinding.TagAsset.ID description: The ID of the tag asset. type: Number - contextPath: RiskSense.HostFinding.TagAsset.Name description: The name of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Category description: The category of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Description description: The description of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Created description: The date and time when tag asset was created. type: String - contextPath: RiskSense.HostFinding.TagAsset.Updated description: The time when the tag asset was last updated. type: String - contextPath: RiskSense.HostFinding.TagAsset.Color description: The color name of the tag asset. type: String - contextPath: RiskSense.HostFinding.Output description: The output of the host finding. type: String - contextPath: RiskSense.HostFinding.Severity description: The severity of the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Combined description: The combined name of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Overridden description: The overridden name of the severity detail for the host finding. type: boolean - contextPath: RiskSense.HostFinding.SeverityDetail.Scanner description: The scanner of the severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.CvssV2 description: The CVSS v2 value of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.CvssV3 description: The CVSS v3 value of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Aggregated description: The aggregated value of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.State description: The state of the severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.StateName description: The state name of the severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.ExpirationDate description: The time when the severity detail expired. type: String - contextPath: RiskSense.HostFinding.RiskRating description: The risk rate of the host finding. type: Number - contextPath: RiskSense.HostFinding.Xrs3Impact description: The impact of xrs3 for the host finding. type: String - contextPath: RiskSense.HostFinding.Xrs3ImpactOnCategory description: The category impact of xrs3 for the host finding. type: String - contextPath: RiskSense.HostFinding.LastFoundOn description: The latest time when the particular host finding is found. type: String - contextPath: RiskSense.HostFinding.DiscoveredOn description: The time when the host finding was discovered. type: String - contextPath: RiskSense.HostFinding.ResolvedOn description: The time when the host finding was resolved. type: String - contextPath: RiskSense.HostFinding.ScannerName description: The name of the scanner of the host finding. type: String - contextPath: RiskSense.HostFinding.FindingType description: The finding type of the host finding. type: String - contextPath: RiskSense.HostFinding.MachineID description: The machine ID of the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.State description: The current state of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.StateName description: The state name of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.StateDescription description: The state description of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.Status description: The status of embedded status associated with the host finding. type: boolean - contextPath: RiskSense.HostFinding.StatusEmbedded.DurationInDays description: The time duration (In days) of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.DueDate description: The due date of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.ExpirationDate description: The time when the status is expired associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReportCount description: The total number of manual finding reports associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.ManualFindingReport.ID description: The ID of manual finding reports associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.ManualFindingReport.Title description: The title of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Label description: The label of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Pii description: The PII number of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Source description: The source of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.IsManualExploit description: Whether the manual finding report is an exploit. type: boolean - contextPath: RiskSense.HostFinding.ManualFindingReport.EaseOfExploit description: The total number of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.NoteCount description: Number of notes found for the host finding. type: Number - contextPath: RiskSense.HostFinding.Note.Date description: The time when the note was added by the user for the host finding. type: String - contextPath: RiskSense.HostFinding.Note.Note description: The notes that were added by the user for the host finding. type: String - contextPath: RiskSense.HostFinding.Note.UserID description: The User ID of the user who added the note for the host finding. type: Number - contextPath: RiskSense.HostFinding.Note.UserName description: The username of the user who added a note for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.ID description: The unique ID of the assignment associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Assignment.FirstName description: The first name of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.LastName description: The last name of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.ReceiveEmails description: Indicates whether the email was received. type: boolean - contextPath: RiskSense.HostFinding.Assignment.Email description: The email address of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.Username description: The username of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Services description: The name of the services for the host finding. type: String - contextPath: Ticket.ID description: The ID of the ticket associated with the host finding. type: String - contextPath: Ticket.State description: The state of the ticket associated with the host finding. type: String - contextPath: Host.Hostname description: The hostname of the host. type: String - contextPath: Host.ID description: The unique ID within the tool retrieving the host. type: String - contextPath: Host.IP description: The IP address of the host. type: String - contextPath: CVE.ID description: Common Vulnerabilities and Exposures ID. type: String - contextPath: CVE.Description description: Description of the CVE. type: String - contextPath: CVE.CVSS description: The CVSS represents the severity of the risk (informational, low, medium, high, critical). type: String - contextPath: RiskSense.HostFinding.Ticket.TicketNumber description: The number of tickets associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.TicketStatus description: The status of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.DeepLink description: The deeplink associated with the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.Type description: The type of ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.ConnectorName description: The connector name of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.DetailedStatus description: The detailed status of the ticket associated with the host finding. type: String - name: risksense-get-apps arguments: - name: fieldname auto: PREDEFINED predefined: - Name - Network - Address description: The RiskSense application attribute that should be considered for filtering the results. The available choices are 'Name', 'Network', or 'Address'. Apart from the available choices, one can provide the attributes supported by RiskSense API. Refer to the API /application/filter API to get the list of supported attributes. The uid of filter attributes must be provided here. e.g. assessment_labels, asset_tags, cvss3BaseI, etc. If specified, 'value' argument is mandatory. - name: operator auto: PREDEFINED predefined: - EXACT - IN - LIKE - BETWEEN description: The match operator should be applied for filtering the hosts based on 'fieldname' and 'value'. Available options are 'EXACT' (filter records exactly matching the criteria), 'IN' (filter records matching any one of the comma-separated values), or 'LIKE' (filter records with the value matching the specified pattern). All the records fieldname value contains the string provided in value; 'BETWEEN' - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. - name: value description: The value of the apps property mentioned in 'fieldname' to be considered for filter criteria. - name: exclude auto: PREDEFINED predefined: - 'true' - 'false' description: The exclude flag that determines whether the returned records matches filter criteria or not. The default is "false". - name: page description: The index of the page. The index is a numeric value and starting with 0. defaultValue: 0 - name: size description: The maximum number of records to fetch in one page. defaultValue: 10 - name: sort_by auto: PREDEFINED predefined: - Address - Name - Network - Total Findings - Critical Findings - Info Findings - Low Findings - Medium Findings - High Findings description: The fieldname that should be considered for sorting the returned records. defaultValue: Name - name: sort_direction auto: PREDEFINED predefined: - Ascending - Descending description: The sorting direction to apply to returned records. defaultValue: Ascending outputs: - contextPath: RiskSense.Application.ID description: The unique ID within the tool retrieving the application. type: Number - contextPath: RiskSense.Application.GroupID description: The group ID of the application. type: Number - contextPath: RiskSense.Application.GroupName description: The group name of the application. type: String - contextPath: RiskSense.Application.Group.ID description: The ID of the group belonging to the Application. type: Number - contextPath: RiskSense.Application.Group.Name description: The name of the group belonging to the Application. type: String - contextPath: RiskSense.Application.Network.ID description: The network ID of the application. type: Number - contextPath: RiskSense.Application.Network.Name description: The network name of the application. type: String - contextPath: RiskSense.Application.Network.Type description: The network type of the application. type: String - contextPath: RiskSense.Application.ClientID description: The client ID of the application. type: Number - contextPath: RiskSense.Application.HostID description: The host ID of the application. type: Number - contextPath: RiskSense.Application.Uri description: The reference URI of the application. type: String - contextPath: RiskSense.Application.Name description: The name of the application. type: String - contextPath: RiskSense.Application.Description description: The detailed description of the application. type: String - contextPath: RiskSense.Application.NoteCount description: The total number of notes found in the application. type: Number - contextPath: RiskSense.Application.DiscoveredOn description: The time when the application was discovered. type: String - contextPath: RiskSense.Application.LastFoundOn description: The time when the application was last found. type: String - contextPath: RiskSense.Application.Total description: The total number of open findings of the application. type: Number - contextPath: RiskSense.Application.Critical description: The number of open findings of the application with critical severity. type: Number - contextPath: RiskSense.Application.High description: The number of open findings of the application with high severity. type: Number - contextPath: RiskSense.Application.Medium description: The number of open findings of the application with medium severity. type: Number - contextPath: RiskSense.Application.Low description: The number of open findings of the application with low severity. type: Number - contextPath: RiskSense.Application.Info description: The number of open findings of the application with info severity. type: Number - contextPath: RiskSense.Application.Icon.Type description: The type of icon of the application. type: String - contextPath: RiskSense.Application.Icon.OverlayText description: The overlay text of the icon of the application. type: String - contextPath: RiskSense.Application.TagCount description: The total number of tags of the application. type: Number - contextPath: RiskSense.Application.UrlCount description: The total number of URLs of the application. type: Number - contextPath: RiskSense.Application.Href description: The deeplink pointing to the application details on RiskSense. type: String - contextPath: RiskSense.Application.CMDB.ManufacturedBy description: The name of the manufacturer in the configuration management DB (CMDB) from application details. type: String - contextPath: RiskSense.Application.CMDB.Model description: The CMDB model name of the application. type: String - contextPath: RiskSense.Application.CMDB.MacAddress description: The CMDB MAC address of the application. type: String - contextPath: RiskSense.Application.CMDB.Location description: The CMDB location of the application. type: String - contextPath: RiskSense.Application.CMDB.ManagedBy description: The CMDB entity name that managed the application. type: String - contextPath: RiskSense.Application.CMDB.OwnedBy description: The CMDB entity name that owned the application. type: String - contextPath: RiskSense.Application.CMDB.SupportedBy description: The CMDB entity name that supported the application. type: String - contextPath: RiskSense.Application.CMDB.SupportGroup description: The CMDB supporting group of the application. type: String - contextPath: RiskSense.Application.CMDB.SysID description: The CMDB system ID of the application. type: String - contextPath: RiskSense.Application.CMDB.OperatingSystem description: The CMDB operating system of the application. type: String - contextPath: RiskSense.Application.CMDB.LastScanDate description: The CMDB last scan date of the application. type: String - contextPath: RiskSense.Application.CMDB.FerpaComplianceAsset description: The Family Educational Rights and Privacy Act. type: Boolean - contextPath: RiskSense.Application.CMDB.HipaaComplianceAsset description: Health Insurance Portability and Accountability Act. type: Boolean - contextPath: RiskSense.Application.CMDB.PciComplianceAsset description: The Payment Card Industry (PCI) Council continues to make changes to ensure that their standards are up to date with emerging threats and changes in the market. type: String - contextPath: RiskSense.Application.Ticket.TicketNumber description: The number of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.TicketStatus description: The status of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.Type description: The type of ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.ConnectorName description: The connector name of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.DetailedStatus description: The detailed status of ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.DeepLink description: The deeplink associated with the ticket associated with the application. type: String - contextPath: RiskSense.Application.Source.Name description: The name of the source associated with the application. type: String - contextPath: RiskSense.Application.Source.UuID description: The unique ID of the source associated with the application. type: String - contextPath: RiskSense.Application.Source.ScannerType description: The type of scanner of the source associated with the application.. type: String - contextPath: RiskSense.Application.Note.UserID description: The user ID of the user who added a note for the application. type: String - contextPath: RiskSense.Application.Note.UserName description: The username of the user who added a note for the application. type: String - contextPath: RiskSense.Application.Note.Note description: The notes that were added by the user for the application. type: String - contextPath: RiskSense.Application.Note.Date description: The time when the note was added by the user for the application. type: String - contextPath: RiskSense.Application.Tag.ID description: The ID of the tag. type: Number - contextPath: RiskSense.Application.Tag.Name description: The name of the tag. type: String - contextPath: RiskSense.Application.Tag.Category description: The category of the tag. type: String - contextPath: RiskSense.Application.Tag.Description description: The description of the tag. type: String - contextPath: RiskSense.Application.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.Application.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.Application.Tag.Color description: The color code of the tag of the application. type: String - contextPath: Ticket.ID description: The ID of the ticket associated with the application. type: String - contextPath: Ticket.State description: The state of the ticket associated with the application. type: String description: Looks up the application details. The application details can be searched based on input parameters like fieldname (Name, Network, Address), operator (EXACT, IN, LIKE, BETWEEN), page, size, sort by and sort direction. - name: risksense-get-host-finding-detail description: Gets in-depth details of a single host finding. The command accepts the host finding ID as an argument. arguments: - name: hostfinding_id description: The unique host finding ID. The host finding ID is either known by RiskSense users or it can be found in the human-readable output or context data(RiskSense.HostFinding.ID) after executing 'risksense-get-host-findings' command. required: true outputs: - contextPath: RiskSense.HostFinding.ID description: The unique ID of the host finding. type: String - contextPath: RiskSense.HostFinding.Source description: Host discovered by the scanner. type: String - contextPath: RiskSense.HostFinding.SourceID description: Scanner ID of the discovered scanner. type: String - contextPath: RiskSense.HostFinding.Title description: The title of the host finding. type: String - contextPath: RiskSense.HostFinding.Port description: The port number of the host finding. type: Number - contextPath: RiskSense.HostFinding.GroupCount description: The total number of groups for the host finding. type: Number - contextPath: RiskSense.HostFinding.GroupID description: The unique ID of the group associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.GroupName description: The name of the group associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Group.ID description: The unique ID of the group associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Group.Name description: The name of the group associated with the host finding. type: String - contextPath: RiskSense.HostFinding.HostID description: The unique ID of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.HostName description: The hostname of the host associated with the host finding. type: String - contextPath: RiskSense.HostFinding.HostIpAddress description: The IP address of the host associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Host.Criticality description: The criticality of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.External description: Whether the host is external. type: boolean - contextPath: RiskSense.HostFinding.Host.Port.ID description: The unique ID of the host(s) port associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.Port.Number description: The port number of the host associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Host.Rs3 description: The Asset Security Score calculated by the RiskSense platform (includes vulnerability risk on related web applications). type: Number - contextPath: RiskSense.HostFinding.Network.ID description: The network ID of the host finding. type: Number - contextPath: RiskSense.HostFinding.Network.Name description: The name of the network used by the host finding. type: String - contextPath: RiskSense.HostFinding.Network.Type description: The type of the network used by the host finding. type: String - contextPath: RiskSense.HostFinding.Assessment.ID description: The assessment ID of the host finding. type: Number - contextPath: RiskSense.HostFinding.Assessment.Name description: The name of the assessment associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Assessment.Date description: The time when the assessment is created. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Cve description: The name of the Common Vulnerabilities and Exposures associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Vulnerability.BaseScore description: CVE Score. type: Number - contextPath: RiskSense.HostFinding.Vulnerability.ThreatCount description: The total number of threats associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Vulnerability.AttackVector description: Vector information in which the host finding was attacked. type: String - contextPath: RiskSense.HostFinding.Vulnerability.AccessComplexity description: Complexity level. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Authentication description: Authentication value represents attackers authorization to get network access. type: String - contextPath: RiskSense.HostFinding.Vulnerability.ConfidentialityImpact description: Confidentiality impact measures the potential impact on the confidentiality of a successfully exploited misuse vulnerability. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Integrity description: Integrity refers to the level of trust and veracity of the information. type: String - contextPath: RiskSense.HostFinding.Vulnerability.AvailabilityImpact description: Availability refers to accessibility of network resources. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Trending description: Whether the vulnerability (which is associated with the hostFinding) has been reported by our internal functions as being trending. type: boolean - contextPath: RiskSense.HostFinding.Vulnerability.VulnLastTrendingOn description: Date when the last trending vulnerability was found. type: String - contextPath: RiskSense.HostFinding.Vulnerability.Description description: A description of the CVE. type: String - contextPath: RiskSense.HostFinding.ThreatCount description: The total number of threats. type: Number - contextPath: RiskSense.HostFinding.Threat.Title description: The title of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Category description: The category of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Severity description: The severity level of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Description description: The threat description. type: String - contextPath: RiskSense.HostFinding.Threat.Cve description: The Common Vulnerabilities and Exposures name of the threat. - contextPath: RiskSense.HostFinding.Threat.Source description: The source of the threat. type: String - contextPath: RiskSense.HostFinding.Threat.Published description: The time when threat was published. type: String - contextPath: RiskSense.HostFinding.Threat.Updated description: The time when the threat was last updated. type: String - contextPath: RiskSense.HostFinding.Threat.ThreatLastTrendingOn description: The last time when the threat was trending. type: String - contextPath: RiskSense.HostFinding.Threat.Trending description: Whether the threat is trending. type: boolean - contextPath: RiskSense.HostFinding.Patch.Name description: The patch name of the host finding. type: String - contextPath: RiskSense.HostFinding.Patch.Url description: The patch URL of the host finding. type: String - contextPath: RiskSense.HostFinding.TagCount description: The total number of tags associated with host finding. type: Number - contextPath: RiskSense.HostFinding.Tag.ID description: The tag identifier of the host finding. type: Number - contextPath: RiskSense.HostFinding.Tag.Name description: The tag name of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Category description: The tag category of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Description description: The tag description of the host finding. type: String - contextPath: RiskSense.HostFinding.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.HostFinding.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.HostFinding.Tag.Color description: The color of the tag. type: String - contextPath: RiskSense.HostFinding.TagAssetCount description: The total number of tag assets. type: Number - contextPath: RiskSense.HostFinding.TagAsset.ID description: The ID of the tag asset. type: Number - contextPath: RiskSense.HostFinding.TagAsset.Name description: The name of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Category description: The category of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Description description: The description of the tag asset. type: String - contextPath: RiskSense.HostFinding.TagAsset.Created description: The time and date when the tag asset was created. type: String - contextPath: RiskSense.HostFinding.TagAsset.Updated description: The time when the tag asset was last updated. type: String - contextPath: RiskSense.HostFinding.TagAsset.Color description: The color name of the tag asset. type: String - contextPath: RiskSense.HostFinding.Output description: The output of the host finding. type: String - contextPath: RiskSense.HostFinding.Severity description: The severity of the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Combined description: The combined name of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Overridden description: The overridden name of the severity detail for the host finding. type: boolean - contextPath: RiskSense.HostFinding.SeverityDetail.Scanner description: The scanner of severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.CvssV2 description: The CVSS v2 value of severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.CvssV3 description: The CVSS v3 value of severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.Aggregated description: The aggregated value of the severity detail for the host finding. type: Number - contextPath: RiskSense.HostFinding.SeverityDetail.State description: The state of the severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.StateName description: The state name of the severity detail for the host finding. type: String - contextPath: RiskSense.HostFinding.SeverityDetail.ExpirationDate description: The time when the severity detail expired. type: String - contextPath: RiskSense.HostFinding.RiskRating description: The risk rate of the host finding. type: Number - contextPath: RiskSense.HostFinding.Xrs3Impact description: The impact of xrs3 for the host finding. type: String - contextPath: RiskSense.HostFinding.Xrs3ImpactOnCategory description: The category impact of xrs3 for the host finding. type: String - contextPath: RiskSense.HostFinding.LastFoundOn description: The latest time when the particular host finding was found. type: String - contextPath: RiskSense.HostFinding.DiscoveredOn description: The time when the host finding was discovered. type: String - contextPath: RiskSense.HostFinding.ResolvedOn description: The time when the host finding was resolved. type: String - contextPath: RiskSense.HostFinding.ScannerName description: The name of the scanner of the host finding. type: String - contextPath: RiskSense.HostFinding.FindingType description: The finding type of the host finding. type: String - contextPath: RiskSense.HostFinding.MachineID description: The machine ID of the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.State description: The current state of the embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.StateName description: The state name of the embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.StateDescription description: The state description of the embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.Status description: The status of the embedded status associated with the host finding. type: boolean - contextPath: RiskSense.HostFinding.StatusEmbedded.DurationInDays description: The time duration (in days) of the embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.DueDate description: The due date of embedded status associated with the host finding. type: String - contextPath: RiskSense.HostFinding.StatusEmbedded.ExpirationDate description: The time when status is expired associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReportCount description: The total number of manual finding reports associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.ManualFindingReport.ID description: The ID of manual finding reports associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.ManualFindingReport.Title description: The title of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Label description: The label of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Pii description: The pii number of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.Source description: The source of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.ManualFindingReport.IsManualExploit description: To check whether manual finding report is exploit or not. type: boolean - contextPath: RiskSense.HostFinding.ManualFindingReport.EaseOfExploit description: The total number of manual finding reports associated with the host finding. type: String - contextPath: RiskSense.HostFinding.NoteCount description: Number of notes found. type: Number - contextPath: RiskSense.HostFinding.Note.Date description: The time when the note was added by the user for the host finding. type: String - contextPath: RiskSense.HostFinding.Note.Note description: The notes that are added by the user for the host finding. type: String - contextPath: RiskSense.HostFinding.Note.UserID description: The User ID of the user who added a note for the host finding. type: Number - contextPath: RiskSense.HostFinding.Note.UserName description: The username of the user who added a note for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.ID description: The unique ID of the assignment associated with the host finding. type: Number - contextPath: RiskSense.HostFinding.Assignment.FirstName description: The first name of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.LastName description: The last name of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.ReceiveEmails description: Indicates whether email is received or not. type: boolean - contextPath: RiskSense.HostFinding.Assignment.Email description: The email of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Assignment.Username description: The username of the assigned user for the host finding. type: String - contextPath: RiskSense.HostFinding.Services description: The name of the services for the host finding. type: String - contextPath: Ticket.ID description: The ID of the ticket associated with the host finding. type: String - contextPath: Ticket.State description: The state of the ticket associated with the host finding. type: String - contextPath: Host.Hostname description: The hostname of the host. type: String - contextPath: Host.ID description: The unique ID within the tool retrieving the host. type: String - contextPath: Host.IP description: The IP address of the host. type: String - contextPath: CVE.ID description: Common Vulnerabilities and Exposures ID. type: String - contextPath: CVE.Description description: Description about the CVE. type: String - contextPath: CVE.CVSS description: The CVSS represents the severity of the risk (informational, low, medium, high, critical). type: String - contextPath: RiskSense.HostFinding.Ticket.TicketNumber description: The number of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.TicketStatus description: The status of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.DeepLink description: The deeplink associated with the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.Type description: The type of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.ConnectorName description: The connector name of the ticket associated with the host finding. type: String - contextPath: RiskSense.HostFinding.Ticket.DetailedStatus description: The detailed status of the ticket associated with the host finding. type: String - name: risksense-get-app-detail arguments: - name: application_id required: true description: The application ID is unique for the application. The application ID is either known by RiskSense users or it can be searched in context output (RiskSense.Application.ID) or in the human-readable output of 'risksense-get-apps' command. outputs: - contextPath: RiskSense.Application.ID description: The unique ID within the tool retrieving the application. type: Number - contextPath: RiskSense.Application.GroupID description: The group ID of the application. type: Number - contextPath: RiskSense.Application.GroupName description: The group name of the application. type: String - contextPath: RiskSense.Application.Group.ID description: The ID of the group belonging to the Application. type: Number - contextPath: RiskSense.Application.Group.Name description: The name of the group belonging to the Application. type: String - contextPath: RiskSense.Application.Network.ID description: The network ID of the application. type: Number - contextPath: RiskSense.Application.Network.Name description: The network name of the application. type: String - contextPath: RiskSense.Application.Network.Type description: The network type of the application. type: String - contextPath: RiskSense.Application.ClientID description: The client ID of the application. type: Number - contextPath: RiskSense.Application.HostID description: The host ID of the application. type: Number - contextPath: RiskSense.Application.Uri description: The reference URI of the application. type: String - contextPath: RiskSense.Application.Name description: The name of the application. type: String - contextPath: RiskSense.Application.Description description: The detailed description of the application. type: String - contextPath: RiskSense.Application.NoteCount description: The total number of notes found in the application. type: Number - contextPath: RiskSense.Application.DiscoveredOn description: The time when the application was discovered. type: String - contextPath: RiskSense.Application.LastFoundOn description: The time when the application was last found. type: String - contextPath: RiskSense.Application.Total description: The total number of open findings of the application. type: Number - contextPath: RiskSense.Application.Critical description: The number of open findings of the application with critical severity. type: Number - contextPath: RiskSense.Application.High description: The number of open findings of the application with high severity. type: Number - contextPath: RiskSense.Application.Medium description: The number of open findings of the application with medium severity. type: Number - contextPath: RiskSense.Application.Low description: The number of open findings of the application with low severity. type: Number - contextPath: RiskSense.Application.Info description: The number of open findings of the application with info severity. type: Number - contextPath: RiskSense.Application.Icon.Type description: The icon type of the application. type: String - contextPath: RiskSense.Application.Icon.OverlayText description: The overlay text of the icon of the application. type: String - contextPath: RiskSense.Application.TagCount description: The total number of tags of the application. type: Number - contextPath: RiskSense.Application.UrlCount description: The total number of URLs of the application. type: Number - contextPath: RiskSense.Application.Href description: The deeplink pointing to the application details on RiskSense. type: String - contextPath: RiskSense.Application.CMDB.ManufacturedBy description: The name of the manufacturer in configuration management DB (CMDB) from application details. type: String - contextPath: RiskSense.Application.CMDB.Model description: The CMDB model name of the application. type: String - contextPath: RiskSense.Application.CMDB.MacAddress description: The CMDB MAC Address of the application. type: String - contextPath: RiskSense.Application.CMDB.Location description: The CMDB location of the application. type: String - contextPath: RiskSense.Application.CMDB.ManagedBy description: The CMDB entity name that managed the application. type: String - contextPath: RiskSense.Application.CMDB.OwnedBy description: The CMDB entity name that owned the application. type: String - contextPath: RiskSense.Application.CMDB.SupportedBy description: The CMDB entity name that supported the application. type: String - contextPath: RiskSense.Application.CMDB.SupportGroup description: The CMDB supporting group of the application. type: String - contextPath: RiskSense.Application.CMDB.SysID description: The CMDB system ID of the application. type: String - contextPath: RiskSense.Application.CMDB.OperatingSystem description: The CMDB Operating system of the application. type: String - contextPath: RiskSense.Application.CMDB.LastScanDate description: The CMDB last scan date of the application. type: String - contextPath: RiskSense.Application.CMDB.FerpaComplianceAsset description: The Family Educational Rights and Privacy Act. type: Boolean - contextPath: RiskSense.Application.CMDB.HipaaComplianceAsset description: Health Insurance Portability and Accountability Act. type: Boolean - contextPath: RiskSense.Application.CMDB.PciComplianceAsset description: The Payment Card Industry (PCI) Council continues to make changes to ensure that their standards are up to date with emerging threats and changes in the market. type: String - contextPath: RiskSense.Application.Ticket.TicketNumber description: The number of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.TicketStatus description: The status of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.Type description: The type of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.ConnectorName description: The connector name of the ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.DetailedStatus description: The detailed status of ticket associated with the application. type: String - contextPath: RiskSense.Application.Ticket.DeepLink description: The deeplink associated with the ticket associated with the application. type: String - contextPath: RiskSense.Application.Source.Name description: The name of the source associated with the application. type: String - contextPath: RiskSense.Application.Source.UuID description: The unique ID of the source associated with the application. type: String - contextPath: RiskSense.Application.Source.ScannerType description: The type of scanner of the source associated with the application.. type: String - contextPath: RiskSense.Application.Note.UserID description: The user ID of the user who added a note for the application. type: String - contextPath: RiskSense.Application.Note.UserName description: The username of the user who added a note for the application. type: String - contextPath: RiskSense.Application.Note.Note description: The notes that are added by the user for the application. type: String - contextPath: RiskSense.Application.Note.Date description: The time when the note was added by the user for the application. type: String - contextPath: RiskSense.Application.Tag.ID description: The ID of the tag. type: Number - contextPath: RiskSense.Application.Tag.Name description: The name of the tag. type: String - contextPath: RiskSense.Application.Tag.Category description: The category of the tag. type: String - contextPath: RiskSense.Application.Tag.Description description: The description of the tag. type: String - contextPath: RiskSense.Application.Tag.Created description: The time when the tag was created. type: String - contextPath: RiskSense.Application.Tag.Updated description: The time when the tag was last updated. type: String - contextPath: RiskSense.Application.Tag.Color description: The color code of the tag of the application. type: String - contextPath: Ticket.ID description: The ID of the ticket associated with the application. type: String - contextPath: Ticket.State description: The state of the ticket associated with the application. type: String description: Gets in-depth details of a single application. The command accepts an application ID as an argument. - name: risksense-apply-tag arguments: - name: propagate_to_all_findings defaultValue: 'false' auto: PREDEFINED predefined: - 'true' - 'false' description: If the given argument is set to true, then it applies the tag to assets as well as findings of assets. Note - It only works if the tag with the given name does not exist. - name: assettype required: true description: Type of asset available in RiskSense to apply the tag. Apart from the available choices, you can provide the asset type supported by RiskSense API. auto: PREDEFINED predefined: - host - hostFinding - application - applicationFinding - name: tagname required: true description: Tag name which applies to the asset(s). - name: fieldname description: The RiskSense asset attribute by which to filter the assets to apply the tag. It can be an attribute of Host, Application, Host Finding, Application Finding. If specified, the 'value' argument is mandatory. - name: operator auto: PREDEFINED predefined: - EXACT - IN - LIKE - BETWEEN description: The match operator should be applied for filtering the assets to apply the tag based on 'fieldname' and 'value'. Can be 'EXACT' - filter records exactly matching the criteria; 'IN' - filter records matching any one of the comma-separated values; 'LIKE' - filter records with the value matching the specified pattern. All the records fieldname value contains the string provided in value; 'BETWEEN' - filter the records with fieldname value falling in the numerical/date range provided. This argument also accepts other operator values supported by the RiskSense API. Refer to the API documentation for the list of supported operators. - name: exclude auto: PREDEFINED predefined: - 'true' - 'false' description: The exclude flag that determines whether to apply the tag on assets matches filter criteria or not. Default set to false. If set to true, tag applied on an asset not matching the specified values. - name: value description: The value of the asset property mentioned in 'fieldname' to be considered for filter criteria. isArray: true outputs: - contextPath: RiskSense.TagAssociation.TagName description: Name of the tag. type: String - contextPath: RiskSense.TagAssociation.AssociationID description: Tag association ID. type: Number - contextPath: RiskSense.TagAssociation.Created description: The time when the tag was associated. type: String description: Apply the new or existing tag to the asset, creates a new tag if it does not exist in RiskSense. dockerimage: demisto/python3:3.12.13.10116658 runonce: false subtype: python3 type: python fromversion: 5.0.0 tests: - RiskSense Get Apps - Test - RiskSense Get Host Detail - Test - RiskSense Get Host Finding Detail - Test - RiskSense Get Hosts - Test - RiskSense Get Host Findings - Test - RiskSense Get Unique Cves - Test - RiskSense Get Unique Open Findings - Test - RiskSense Get Apps Detail - Test - RiskSense Apply Tag - Test