args:
- description: A comma-separated list of CVEs to enrich.
  name: cve_list
  required: true
  isArray: true
- name: external_enrichment
  description: |
    Whether to call external integrations for enrichment.
    - 'true': enrich using enabled external integrations (e.g., CIRCL CVE Search, CVE Search v2).
    - 'false': use only existing TIM data; skip external integrations.
    If the 'brands' argument is provided, this flag is ignored and enrichment is run only on the brands provided.
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  defaultValue: 'false'
  required: false
- name: verbose
  description: Whether to retrieve a human-readable entry for every command; if false, only the final result is summarized and error entries are suppressed.
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  defaultValue: 'false'
  required: false
- name: brands
  description: |
    A list of integration brands to run enrichment against.  
    Example: `"CIRCL CVE Search, CVE Search v2"`.  
    - If provided, only the selected brands are used. 
    - If left empty, the script runs enrichment on all enabled integrations,
      depending on the `external_enrichment` flag.
    To see the available brands for the `cve` command, run: `!ProvidesCommand command=cve`.
  isArray: true
  required: false
- name: additional_fields
  description: |
    When set to true, the output will also include an `AdditionalFields` object
    for each of the indicator result.  
    `AdditionalFields` contains all fields returned by TIM or the integrations
    that are not part of the standard output keys: `ID`, `Brand`, `CVSS`, 
    `Description`, `Published`.  
    When set to false, only the standard keys are returned.
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  required: false
  defaultValue: 'false'
comment: 'Enriches CVE indicators with reputation data from multiple integrations and outputs a consolidated CVEEnrichment object. This script exclusively supports indicators of type CVE and will automatically create the indicator in TIM if it is not already exists.'
commonfields:
  id: cve-enrichment
  version: -1
enabled: false
name: cve-enrichment
outputs:
# CVEEnrichment
- contextPath: CVEEnrichment.Value
  description: The CVE.
  type: string
- contextPath: CVEEnrichment.TIMCVSS
  description: The max CVSS of the indicator.
  type: number
- contextPath: CVEEnrichment.Results
  description: List of all indicators found for the CVE.
  type: array
- contextPath: CVEEnrichment.Status
  description: 'The status of the indicator: "Manual" if the score was changed manually, "Fresh" if modified within the last week, "Stale" if modified more than a week ago, "Error" if enrichment Failed, and "None" if never modified.'
  type: string
- contextPath: CVEEnrichment.Message
  description: The error message explaining the reason for the failure (e.g., "Invalid", "createIndicator failed", etc.).
  type: string
# CVEEnrichment Main Keys
- contextPath: CVEEnrichment.Results.ID
  description: The ID of the indicator.
  type: string
- contextPath: CVEEnrichment.Results.Brand
  description: The brand of the indicator.
  type: string
- contextPath: CVEEnrichment.Results.CVSS
  description: The CVSS of the indicator.
  type: number
- contextPath: CVEEnrichment.Results.Description
  description: The description of the indicator.
  type: string
- contextPath: CVEEnrichment.Results.Published
  description: The published date of the indicator.
  type: string
- contextPath: CVEEnrichment.Results.Status
  description: 'The status of the indicator: "Manual" if the score was changed manually, "Fresh" if modified within the last week, "Stale" if modified more than a week ago, and "None" if never modified.'
  type: string
- contextPath: CVEEnrichment.Results.ModifiedTime
  description: The time the indicator was last modified.
  type: Date
# CVEEnrichment Additional Fields
- contextPath: CVEEnrichment.Results.AdditionalFields
  description: All fields extracted from the indicator other then the main keys ("ID", "Brand", "CVSS", "Description", "Published", "CVSS").
  type: Object
- contextPath: CVEEnrichment.Results.AdditionalFields.Relationships.EntityA
  description: The source of the relationship.
  type: string
- contextPath: CVEEnrichment.Results.AdditionalFields.Relationships.EntityB
  description: The destination of the relationship.
  type: string
- contextPath: CVEEnrichment.Results.AdditionalFields.Relationships.Relationship
  description: The name of the relationship.
  type: string
- contextPath: CVEEnrichment.Results.AdditionalFields.Relationships.EntityAType
  description: The type of the source of the relationship.
  type: string
- contextPath: CVEEnrichment.Results.AdditionalFields.Relationships.EntityBType
  description: The type of the destination of the relationship.
  type: string
- contextPath: CVEEnrichment.Results.AdditionalFields.Modified
  description: The timestamp of when the CVE was last modified.
  type: Date
script: '-'
system: false
tags:
- basescript
timeout: '0'
type: python
subtype: python3
dockerimage: demisto/python3:3.12.13.10116658
fromversion: 8.0.0
marketplaces:
- xsoar_saas
- marketplacev2
- platform
tests:
- CVEEnrichment-Test