deprecated: true
id: vulnerability_management_-_nexpose_job
version: -1
name: Vulnerability Management - Nexpose (Job)
fromversion: 5.0.0
description: |-
  Deprecated. No available replacement. Manage assets vulnerabilities using Nexpose.

  This playbook runs as a job, and by default creates incidents of type "Vulnerability" based on assets and vulnerabilities.
  The incidents are created by querying Nexpose for the input assets vulnerability list.
  You can define the minimum severity (minSeverity) that incidents are created for.
  Duplicate incidents are not created for the same asset ID and the Nexpose ID.

  This playbook is a part of a series of playbooks for Nexpose vulnerability management and remediation.
  For this series of playbooks to run successfully, create a Job and do the following:
  1. Assign this playbook to the Job
  2. Enter the relevant assets' hostnames in the playbook inputs (comma separated list).
  3. Associate the "Vulnerability" type incident to the "Vulnerability Handling - Nexpose" playbook.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 262846f7-b22f-4bb4-8726-c0e9908239c7
    type: start
    task:
      id: 262846f7-b22f-4bb4-8726-c0e9908239c7
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 50
        }
      }
  "1":
    id: "1"
    taskid: 705f459e-8a36-425a-8895-9acb80e6590a
    type: regular
    task:
      id: 705f459e-8a36-425a-8895-9acb80e6590a
      version: -1
      name: Get assets' information
      description: Query Nexpose for the assets' information.
      script: Rapid7 Nexpose|||nexpose-search-assets
      type: regular
      iscommand: true
      brand: Rapid7 Nexpose
    nexttasks:
      '#none#':
      - "2"
      - "7"
    scriptarguments:
      hostNameIs:
        complex:
          root: inputs.Hostname
          transformers:
          - operator: string.splitAndTrim
            args:
              delimiter:
                value:
                  simple: ','
      ipAddressIs: {}
      limit: {}
      match: {}
      query: {}
      riskScoreHigherThan: {}
      siteIdIn: {}
      sort: {}
      vulnerabilityTitleContains: {}
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
  "2":
    id: "2"
    taskid: f0e9c893-d62c-44d7-8d7a-505f13d19c9c
    type: title
    task:
      id: f0e9c893-d62c-44d7-8d7a-505f13d19c9c
      version: -1
      name: Enrich assets
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
  "3":
    id: "3"
    taskid: 59f0f9f6-ddfa-44ef-8768-6754855f9efb
    type: regular
    task:
      id: 59f0f9f6-ddfa-44ef-8768-6754855f9efb
      version: -1
      name: Get assets' reports
      description: Query Nexpose for the latest assets' reports.
      script: Rapid7 Nexpose|||nexpose-create-assets-report
      type: regular
      iscommand: true
      brand: Rapid7 Nexpose
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      assets:
        complex:
          root: Nexpose
          accessor: Asset.AssetId
      name: {}
      template: {}
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 690
        }
      }
  "5":
    id: "5"
    taskid: a9c0c0e6-55eb-4f19-8c8b-675bcdb21138
    type: condition
    task:
      id: a9c0c0e6-55eb-4f19-8c8b-675bcdb21138
      version: -1
      name: Is Nexpose enabled?
      description: |
        Verify that there is a valid instance of Nexpose enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "1"
    reputationcalc: 0
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Rapid7 Nexpose
                    ignorecase: true
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 377.5,
          "y": 195
        }
      }
  "6":
    id: "6"
    taskid: 15066fb2-3cbe-448c-8cdf-f6560d23a013
    type: title
    task:
      id: 15066fb2-3cbe-448c-8cdf-f6560d23a013
      version: -1
      name: Close investigation
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 862
        }
      }
  "7":
    id: "7"
    taskid: f893f0f5-10ea-43ea-8fc7-53a9e51d0e6c
    type: title
    task:
      id: f893f0f5-10ea-43ea-8fc7-53a9e51d0e6c
      version: -1
      name: Create incidents
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 545
        }
      }
  "8":
    id: "8"
    taskid: 8cac3cd1-2a87-45a5-8456-30991f126957
    type: regular
    task:
      id: 8cac3cd1-2a87-45a5-8456-30991f126957
      version: -1
      name: Create Incidents for assets and vulnerabilities
      description: |-
        Create incidents based on the Nexpose asset ID and vulnerability ID.
        Duplicate incidents are not created for the same asset ID and vulnerability ID.
      scriptName: NexposeCreateIncidentsFromAssets
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      assetID:
        complex:
          root: Nexpose
          accessor: Asset.AssetId
      incidentType: {}
      minSeverity:
        simple: ${inputs.MinSeverity}
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 690
        }
      }
  "9":
    id: "9"
    taskid: 100c24b9-566a-4dc6-8e41-ed1de7ed8a32
    type: regular
    task:
      id: 100c24b9-566a-4dc6-8e41-ed1de7ed8a32
      version: -1
      name: Close investigation
      description: Close the investigation
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      id: {}
      importantfield: {}
      test2: {}
      timefield1: {}
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1010
        }
      }
  "10":
    id: "10"
    taskid: d6469ba0-ed85-42d0-80e6-770fe1ca044a
    type: title
    task:
      id: d6469ba0-ed85-42d0-80e6-770fe1ca044a
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    reputationcalc: 0
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 480,
          "y": 1185
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1200,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: Hostname
  value: {}
  required: false
  description: Assets' hostnames list (comma separated).
- key: MinSeverity
  value:
    simple: Severe
  required: true
  description: The minimum Nexpose severity (Moderate, Severe, Critical) to create incidents for.
outputs: []
tests:
- No test
marketplaces:
  - xsoar