Package Documentation
Storm Package: synapse-vulncheck
The following Commands are available from this package. This documentation is generated for version 2.0.0 of the package.
Storm Commands
This package implements the following Storm Commands.
vulncheck.config.add
Add a Synapse-Vulncheck configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Add a global configuration
vulncheck.config.add default myapikey1234
// Add a configuration for the current user
vulncheck.config.add --scope self myconfig myapikey5678
Usage: vulncheck.config.add [options] <name> <apikey>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--scope <scope> : Set the scope on the configuration. (default: global, choices: global, self, unscoped)
Arguments:
<name> : A unique name for the configuration.
<apikey> : The Vulncheck API key string.
The command is accessible to users with one or more of the following permissions:
power-ups.vulncheck.adminpower-ups.vulncheck.user
vulncheck.config.del
Delete a Synapse-Vulncheck configuration.
Examples:
// Delete the "myconfig" configuration
vulncheck.config.del myconfig
Usage: vulncheck.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.vulncheck.adminpower-ups.vulncheck.user
vulncheck.config.list
Display the list of Synapse-Vulncheck configurations you have access to.
Usage: vulncheck.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.vulncheck.adminpower-ups.vulncheck.user
vulncheck.config.migrate
Migrate options for all Synapse-Vulncheck configurations.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Disable SSL verification for all configurations
vulncheck.config.migrate --ssl-verify (false)
Usage: vulncheck.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.vulncheck.admin
vulncheck.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
vulncheck.config.show
// Show a configuration by name
vulncheck.config.show myconfig
Usage: vulncheck.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.vulncheck.adminpower-ups.vulncheck.user
vulncheck.config.update
Update the configuration of a defined Synapse-Vulncheck configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Set the permission level for user "myuser" to "admin" on the "myconfig"
// configuration
vulncheck.config.update myconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "myconfig" configuration
vulncheck.config.update myconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "myconfig"
vulncheck.config.update myconfig --ssl-verify (false)
// Change the name of the "myconfig" configuration to "otherconfig"
vulncheck.config.update myconfig --name otherconfig
Usage: vulncheck.config.update [options] <config>
Options:
--help : Display the command usage.
--apikey <apikey> : The Vulncheck API key string. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are ``scope``, ``name``, ``level``:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level name, or (null) to remove the
permission, which falls back to the config default.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--name <name> : Rename the configuration. (default: None)
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.vulncheck.adminpower-ups.vulncheck.user
vulncheck.enrich
Enrich a node with additional information from Vulncheck.
This command accepts risk:vuln nodes as input and queries the Vulncheck
exploits, botnets, ransomware, threat-actors, and vulncheck-nvd2 indexe
to retrieve additional information about the CVE.
Examples:
// Enrich a risk:vuln node.
risk:vuln:cve=CVE-2019-3396 | vulncheck.enrich
// Enrich an it:sec:cve node and yield the results.
it:sec:cve=CVE-2019-3396 | vulncheck.enrich --yield
Usage: vulncheck.enrich [options]
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
Inputs:
it:sec:cve : Search for exploits and vulnerabilities by CVE.
risk:vuln : Search for exploits and vulnerabilities by CVE identifier of a risk:vuln.
The command is accessible to users with one or more of the following permissions:
power-ups.vulncheck.adminpower-ups.vulncheck.user
vulncheck.index
Ingest an index from the Vulncheck API.
The --since-last option can be used to set up a cron job that will automatically
increment the last modified start date with a globally stored value. Only a
single cron job using --since-last should be implemented to ensure that results
are contiguous in the view it is running.
The first time --since-last is used the --lastModStartDate argument will define
the starting point, otherwise the --lastModStartDate argument is ignored when
--since-last is specified. The --lastModEndDate argument is always ignored
when --since-last is specified.
Supported Indexes:
botnets
exploits
ransomware
threat-actors
vulncheck-nvd2
Examples:
// Ingest the threat-actors index.
vulncheck.index threat-actors
// Ingest updated entries in the threat-actors index and yield the results.
vulncheck.index threat-actors --since-last --yield
// Create a cron job to ingest any new results every day.
cron.add --name "Vulncheck Actor Feed" --hour 4 { vulncheck.index threat-actors --since-last }
Usage: vulncheck.index [options] <name>
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--since-last : Retrieve results modified since the last run of the command with --since-last
specified.
--lastModStartDate <lastModStartDate>: Specify a starting last modified date to filter with.
--lastModEndDate <lastModEndDate>: Specify an ending last modified date to filter with.
--config <config> : Override the default config with the provided name.
Arguments:
<name> : The name of the index to ingest.
The command is accessible to users with one or more of the following permissions:
power-ups.vulncheck.adminpower-ups.vulncheck.user
vulncheck.search
Use a text string to query Vulncheck.
This command takes CVE IDs as a parameter to query the Vulncheck exploits
and vulerabilities APIs for information about the CVE.
Examples:
// Search for a CVE and yield the results.
vulncheck.search CVE-2019-3396 --yield
Usage: vulncheck.search [options] <query>
Options:
--help : Display the command usage.
--debug : Show verbose debug output.
--size <size> : Limit the number of results ingested to the given size.
--yield : Yield the newly created nodes.
--config <config> : Override the default config with the provided name.
Arguments:
<query> : The query string.
The command is accessible to users with one or more of the following permissions:
power-ups.vulncheck.adminpower-ups.vulncheck.user
Storm Modules
This package does not export any Storm APIs.