id: Check Point - Vulnerability Exploitation Monitoring
version: -1
name: Check Point - Vulnerability Exploitation Monitoring
description: |-
  Enriches CVEs from a vulnerability-management incident with Cyberint vulnerability intelligence and prioritizes them based on real-world exploitation.

  For each CVE the playbook retrieves the Cyberint CVE score, CVSS, EPSS, CWE and active-exploitation evidence. When a CVE exceeds the configured risk thresholds or is being actively exploited, the incident is escalated and a patch-remediation ticket is opened; otherwise the CVE is tagged as monitored.

  Connect the remediation task to your ticketing system and CMDB to fully automate risk-based vulnerability management.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f160d6af-0d9c-4d0f-8798-7c07a7e9f5f7
    type: start
    task:
      id: f160d6af-0d9c-4d0f-8798-7c07a7e9f5f7
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 891f6756-cdc1-4016-aa58-b16ccead5651
    type: condition
    task:
      id: 891f6756-cdc1-4016-aa58-b16ccead5651
      version: -1
      name: Is the Check Point EM Feed integration enabled?
      description: Runs the IsIntegrationAvailable script against the Check Point EM Feed integration so the playbook can short-circuit gracefully if no instance is configured.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: Builtin
    nexttasks:
      "no":
      - "11"
      "yes":
      - "1"
    scriptarguments:
      brandname:
        simple: Cyberint Feed
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 45
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 7b86d77a-d724-4acc-a8d6-be1c77ff9757
    type: title
    task:
      id: 7b86d77a-d724-4acc-a8d6-be1c77ff9757
      version: -1
      name: Check Point EM Feed Not Available
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 870,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: fa33b71f-16ee-4e08-a67d-c022674c886e
    type: condition
    task:
      id: fa33b71f-16ee-4e08-a67d-c022674c886e
      version: -1
      name: Are there CVEs to monitor?
      type: condition
      iscommand: false
      brand: ""
      description: Checks whether the playbook received any CVE identifiers from the vulnerability-management incident.
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.CVE
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 78662752-909a-4902-8b15-097ab4a94ee9
    type: regular
    task:
      id: 78662752-909a-4902-8b15-097ab4a94ee9
      version: -1
      name: Enrich CVEs with Check Point Exposure Management intelligence
      description: Matches each CVE against the Check Point EM CVE intelligence API, retrieving the Cyberint CVE score, CVSS, EPSS, CWE and active-exploitation evidence. The task is skipped if the Check Point EM Feed integration is not enabled, allowing the playbook to continue gracefully.
      script: '|||cyberint-cve-enrich'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      cve_id:
        complex:
          root: inputs.CVE
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "3":
    id: "3"
    taskid: 852fc64b-435d-400e-8cfe-faf13ae966bd
    type: condition
    task:
      id: 852fc64b-435d-400e-8cfe-faf13ae966bd
      version: -1
      name: Does a CVE exceed the risk thresholds?
      type: condition
      iscommand: false
      brand: ""
      description: Escalates when any enriched CVE exceeds the configured Cyberint, CVSS or EPSS thresholds, or is being actively exploited in the wild.
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Cyberint.CVE.cyberint_score
            iscontext: true
          right:
            value:
              simple: inputs.CyberintScoreThreshold
            iscontext: true
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Cyberint.CVE.cvss.cvss_v3.base_score
            iscontext: true
          right:
            value:
              simple: inputs.CVSSThreshold
            iscontext: true
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Cyberint.CVE.cvss.cvss_v4.base_score
            iscontext: true
          right:
            value:
              simple: inputs.CVSSThreshold
            iscontext: true
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: Cyberint.CVE.epss
            iscontext: true
          right:
            value:
              simple: inputs.EPSSThreshold
            iscontext: true
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Cyberint.CVE.exploited_by
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 575c85e3-d060-4d65-9c46-0af04c080385
    type: regular
    task:
      id: 575c85e3-d060-4d65-9c46-0af04c080385
      version: -1
      name: Escalate - actively exploited vulnerability
      description: Raises the incident severity and tags it because Cyberint indicates the vulnerability poses a real-world exploitation risk.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      severity:
        simple: "3"
      tags:
        simple: cyberint-active-exploitation
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 270,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 363cdc1c-dd43-44f4-8825-33c9fb22799f
    type: regular
    task:
      id: 363cdc1c-dd43-44f4-8825-33c9fb22799f
      version: -1
      name: Open patch remediation ticket and update CMDB
      description: |-
        Open a patch-remediation ticket for the affected asset and append the Cyberint CVE intelligence (Cyberint score, CVSS, EPSS, CWE and exploitation evidence from the Cyberint.CVE context) to the ticket. Update the asset database / CMDB record for the affected asset accordingly.

        Wire this task to your ticketing-system integration (for example jira-create-issue, servicenow-create-ticket or zendesk-create-ticket) and surface the created ticket identifier under the Ticket.ID output so downstream playbooks and dashboards can reference it.

        Expected output mapping for the ticket created here:
          Ticket.ID         - the identifier returned by the ticketing system (e.g. Jira issue key, ServiceNow sys_id).
          Ticket.URL        - direct link to the ticket in the ticketing system (optional).
          Ticket.Status     - initial status (optional).
      scriptName: Print
      type: regular
      iscommand: false
      brand: Builtin
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      value:
        simple: |-
          Open a patch-remediation ticket for the affected asset and update the CMDB record.
          Affected CVE(s): ${Cyberint.CVE.cve_id}
          Cyberint score: ${Cyberint.CVE.cyberint_score} | CVSS v3 base score: ${Cyberint.CVE.cvss.cvss_v3.base_score} | EPSS: ${Cyberint.CVE.epss}
          Exploited by: ${Cyberint.CVE.exploited_by}
          Wire this task to your ticketing-system integration (jira-create-issue, servicenow-create-ticket or zendesk-create-ticket) and surface the created ticket identifier under the Ticket.ID output so downstream playbooks and dashboards can reference it.
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 270,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: bfeff0a4-2a76-4c70-9967-a1e6be3ef1c1
    type: regular
    task:
      id: bfeff0a4-2a76-4c70-9967-a1e6be3ef1c1
      version: -1
      name: Tag incident as monitored
      description: No CVE exceeded the configured risk thresholds. Tags the incident as monitored so it can be handled through standard patch cycles.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      tags:
        simple: cyberint-vulnerability-monitored
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 660,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: a41e7266-09a4-4798-bcc9-39680058e5c4
    type: title
    task:
      id: a41e7266-09a4-4798-bcc9-39680058e5c4
      version: -1
      name: Vulnerability Monitoring Complete
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 276ea124-07cf-4d2f-8428-196233da702b
    type: title
    task:
      id: 276ea124-07cf-4d2f-8428-196233da702b
      version: -1
      name: No CVEs to Monitor
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 405
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 74d714b5-10f9-4227-9e20-7a4a50b1afa4
    type: title
    task:
      id: 74d714b5-10f9-4227-9e20-7a4a50b1afa4
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "8_12_none": 0.76
    },
    "paper": {
      "dimensions": {
        "height": 1380,
        "width": 1200,
        "x": 50,
        "y": -70
      }
    }
  }
inputs:
- key: CVE
  value:
    complex:
      root: CVE
      accessor: ID
  required: false
  description: 'CVE identifiers to monitor. Expected format: ``CVE-YYYY-NNNNN`` (case-insensitive). Accepts a comma-separated list, e.g. ``CVE-2024-12345,CVE-2023-44487``. Defaults to CVE indicators extracted from the incident.'
  playbookInputQuery:
- key: CyberintScoreThreshold
  value:
    simple: "7"
  required: false
  description: 'Cyberint CVE score (0-10) at or above which the incident is escalated. Accepts a single number, e.g. ``7`` or ``8.5``. Default is 7.'
  playbookInputQuery:
- key: CVSSThreshold
  value:
    simple: "7"
  required: false
  description: 'CVSS base score (0-10) at or above which the incident is escalated. Accepts a single number, e.g. ``7`` or ``9.8``. Default is 7.'
  playbookInputQuery:
- key: EPSSThreshold
  value:
    simple: "0.5"
  required: false
  description: 'EPSS probability score (0-1) at or above which the incident is escalated. Accepts a single number between 0 and 1, e.g. ``0.5`` or ``0.97``. Default is 0.5.'
  playbookInputQuery:
outputs:
- contextPath: Cyberint.CVE
  description: The Cyberint CVE intelligence results, including the Cyberint score, CVSS, EPSS, CWE and active-exploitation evidence.
  type: unknown
- contextPath: CVE
  description: The CVE indicator objects produced by the enrichment.
  type: unknown
- contextPath: Ticket.ID
  description: The identifier of the patch-remediation ticket created for the affected asset. Populated by the customer's ticketing-system integration wired into the "Open patch remediation ticket and update CMDB" task (for example jira-create-issue, servicenow-create-ticket).
  type: string
tests:
- Check Point - Vulnerability Exploitation Monitoring - Test
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
- platform