IBM Security SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

Enhance CVE Search to Artifacts, and add results in Notes and Artifact Description 

Mon August 26, 2019 05:47 AM

Prerequisit : have the CVE Search integration installed and configured Link to App Exchange Purpose : Enhance the standard information given by this integration in Artifact Description & Note and add a search button action on a CVE artifact type. Note, if searched already once, the action button is disable for this artifact. Changes : New Rule CVE Look-up on CVE type artifact, that will not show up in Action button if already launched. New Workflow CVE Lookup as duplicate of the Example: CVE Search with changes in post process scripts The result if failed is: in a Note in the artifact description if success: in note, nothing, the CVE table gets a new line ! in artifact description Attached is the res file to import this configuration. Feel free to use, change, adapt this code to your usage. Building the res file: resilient-circuits extract --workflow "cve_lookup" --rule "CVE Search" "CVE Browse" "CVE Look-up" -o config_CVE.res --zip

Statistics
0 Favorited
14 Views
1 Files
0 Shares
4 Downloads
Attachment(s)
zip file
config_CVE.res.zip   29 KB   1 version
Uploaded - Mon August 26, 2019

Comments

Mon August 26, 2019 08:54 AM

Good one! Thanks!