Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE updates - type, layouts and CVEsearchV2 #26486

Merged
merged 237 commits into from
Jun 29, 2023
Merged

CVE updates - type, layouts and CVEsearchV2 #26486

merged 237 commits into from
Jun 29, 2023

Conversation

Ni-Knight
Copy link
Contributor

@Ni-Knight Ni-Knight commented May 14, 2023 •
edited
Loading

Status

  • In Progress
  • Ready
  • In Hold - (Reason for hold)

Related Issues

fixes: link to the issue

Description

The PR is an overhaul to the CVE type within the system allowing to represent CPEs, CWEs, CVSS (Score and table) and more. The PR updates:

  1. CVE Type
  2. CVE Layout
  3. New indicator field Vulnerable Products
  4. Updating the CVE Class in CSP and adding CPE support (New class like Publications)
  5. All new data parsing from CVESearchV2 integration
  6. New relationships and tags to CVEs

Screenshots

image

Minimum version of Cortex XSOAR

  • 6.0.0
  • 6.1.0
  • 6.2.0
  • 6.5.0

Does it break backward compatibility?

  • Yes
    • Further details:
  • No

@Ni-Knight Ni-Knight requested review from altmannyarden and removed request for michalgold and idovandijk May 14, 2023 13:52
@content-bot
Copy link
Collaborator

This PR was automatically updated by a GitHub Action

  • CommonTypes pack version was bumped to 3.3.77.

To stop automatic version bumps, add the ignore-auto-bump-version label to the github PR.

@content-bot
Copy link
Collaborator

This PR was automatically updated by a GitHub Action

  • CommonScripts pack version was bumped to 1.11.90.

To stop automatic version bumps, add the ignore-auto-bump-version label to the github PR.

eyalpalo
eyalpalo requested changes Jun 27, 2023
View reviewed changes
Copy link
Contributor

@eyalpalo eyalpalo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Demo notes:

  1. Better exception message
  2. fix the get id failure
  3. test module + return_outputs

Packs/CIRCL/Integrations/CirclCVESearch/CirclCVESearch.py Outdated Show resolved Hide resolved
eyalpalo
eyalpalo approved these changes Jun 28, 2023
View reviewed changes
Copy link
Contributor

@eyalpalo eyalpalo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work

@content-bot
Copy link
Collaborator

This PR was automatically updated by a GitHub Action

  • CommonScripts pack version was bumped to 1.11.91.

To stop automatic version bumps, add the ignore-auto-bump-version label to the github PR.

@Ni-Knight Ni-Knight merged commit 8522eab into master Jun 29, 2023
@Ni-Knight Ni-Knight deleted the DRA-CVE-UPDATE branch June 29, 2023 09:21
xsoar-bot pushed a commit to xsoar-contrib/content that referenced this pull request Jul 26, 2023
@Ni-Knight @ilaner
@adi88d @ShirleyDenkberg @eyalpalo @xsoar-bot
CVE updates - type, layouts and CVEsearchV2 (demisto#26486)
ef0e7e7 
* Updated the integration to parse all the data coming from the source.

* Updated the Common.CVE class with new attributes needed for the changes made to the CVE type.

* New indicator fields - "Vulnerable Products" and "Vulnerable Configurations"

* New script to support a new dynamic section in the CVE layout.

* Updated layout for CVEs.

* New and improved custom mapping for CVEs.

* Small fix to comments section in the layout

* Added "KeyError" handling to the automation if no CVSS score is present.

* Small fixes and docstrings.

* Updated fromVersion.

* RN

* ignore "CPE" and "CPEs".

* ignore "CWE" and "CWEs".

* Small fixes to errors in CSP.

* Switched branch name back to `master` in CSP.

* Reverted doc_stirng to reinclude dbot info.

* Fixed field name from "description" to "comment"

* PEP8 fixes

* Docker bump

* Readme update

* code fixes and unit-tests

* Bump pack from version CommonTypes to 3.3.69.

* Fixed tags and escape characters

* Typo

* readme fixes

* Bump pack from version CommonTypes to 3.3.70.

* Update CVECVSSColor.py

* Update CVECVSSColor_test.py

* RN

* Removed `script` from yml

* Some more tests for indicator generation

* Bump pack from version Base to 1.32.3.

* More tests for the new code sections

* Added relationships to tests

* Update CVECVSSColor.py

* Fixed issue with relationships being referenced before assignment

* Updated test playbook

* Bump pack from version CommonScripts to 1.11.75.

* Bump pack from version Base to 1.32.4.

* A bit more comments

* Fixed `ruff` errors

* Bumped docker

* RN

* Bump pack from version CommonScripts to 1.11.76.

* CR fixes

* Updated readme file

* ReleaseNotes

* Updated YML

* ReleaseNotes

* Fixed YML

* Updated breaking changes

* ignore BC102 error

* ReleaseNotes

* fixed ignore

* Update .pack-ignore

* Bump pack from version CommonScripts to 1.11.78.

* Bump pack from version CommonScripts to 1.11.79.

* Adding an explenation for the change in the context.

* Docker bumps

* RN

* Bump pack from version CommonScripts to 1.11.80.

* Restored script name that was deleted by format

* docker bump

* RN

* Fixed small error in unit test

* Bump pack from version CommonScripts to 1.11.81.

* Fixed CPE parsing to support multiple products.

* Fixed tags being overwritten.

* CveReputation update to Python3

* Updated cpes to a single grid

* Updated layout with fixes to quick and edit

* Moved integration to CIRCL and reverted changes in CVESearch

* Reverting changes to CVESearch Pack

* Deprecating CVESearch

* Delete Pipfile.lock

* Delete Pipfile

* RN

* Update .secrets-ignore

* pip8 issues

* New picture

* docs updates

* Bump pack from version CommonScripts to 1.11.83.

* added script key to yml

* added "python" to code block

* Added unittests for the script

* Fixed typing hint

* typing hint

* Hint yet again

* Added a python3 docker key to the yml

* RN

* update poetry setup version

* Bump pack from version CommonScripts to 1.11.84.

* Validation fixes

* Bump pack from version Base to 1.32.8.

* Update conf.json

Removed unneeded square brackets

* Fixed import path

* Update indicatorfield-vulnerableproducts.json

typo (missing an "s" in products)

* typo fixes (changed to vulnerableproducts from vulnerableproduct)

* vulnerableproduct -> vulnerableproducts in Common.CVE

* Camel in context keys

* vulnerableproducts -> VulnerableProducts in mapping

* Apply suggestions from code review

Co-authored-by: ShirleyDenkberg <[email protected]>

* Updated ExtraHop PB to use new integration.

* RN

* RN

* vulnerableproduct - > vulnerableproducts

* Update 3_3_73.md

Changing due a validation issue.

* Removed deprecated pack CVE Search

* RN

* Bump pack from version CommonScripts to 1.11.86.

* removed CVESearch from nightly (deprecated)

* Added CIRCL to nightly packs

* RN

* Update pack_metadata.json

* Update pack_metadata.json

* Update playbook-ExtraHop_-_CVE-2019-0708_BlueKeep.yml

* Update pack_metadata.json

* RN

* ReleaseNotes

* RN

* Update 1_0_19.md

* ignore CJ105 in CveReputation.yml

* RN

* Update CveReputation.yml

* Changed cve_id to cve

* Deprecated notifications

* RN

* RN

* RN

* added "toversion" again to try

* Bump pack from version Base to 1.32.15.

* Bump pack from version CommonScripts to 1.11.88.

* docker bump

* RN

* RN

* Test fixes to use "cve"

* PB Fix

* fromversion fix.

* Apply suggestions from code review

Co-authored-by: EyalPintzov <[email protected]>

* CR fixes

* More CR changes

* RN

* typo

* missing `return` after change

* fix to tests

* Update conf.json

Added "CIRCL" to nightly packs instead of CVESearchV2

* cvss_color fix

* RN

* Fixed test_module

* catching bad JSON

* `cve_id`->`cve`

* Fixes to mypy issues.

* Bump pack from version CommonTypes to 3.3.77.

* Bump pack from version CommonScripts to 1.11.90.

* Update Packs/CIRCL/Integrations/CirclCVESearch/CirclCVESearch.py

Co-authored-by: EyalPintzov <[email protected]>

* Fixed "id" issue and better exception for bad URL

* Fixed mypy issues and ruff

* RN

* RN

* Update CVESearchV2.yml

no need for toVersion as its deprcated

* Bump pack from version CommonScripts to 1.11.91.

* removing toversion from cvereputatoin and changing id to V2

* RN

* RN

* updated comment

---------

Co-authored-by: Content Bot <[email protected]>
Co-authored-by: ilaner <[email protected]>
Co-authored-by: adi88d <[email protected]>
Co-authored-by: ShirleyDenkberg <[email protected]>
Co-authored-by: EyalPintzov <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ShirleyDenkberg ShirleyDenkberg ShirleyDenkberg left review comments

@ostolero ostolero ostolero left review comments

@altmannyarden altmannyarden altmannyarden approved these changes

@eyalpalo eyalpalo eyalpalo approved these changes

Assignees

@Ni-Knight Ni-Knight

Labels
docs-approved
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@Ni-Knight @content-bot @ShirleyDenkberg @altmannyarden @ostolero @eyalpalo @ilaner @adi88d