topic import vendor security advisories for comparison with inventory in Getting Data In

import vendor security advisories for comparison with inventory

Andre_ — Fri, 28 Mar 2025 01:20:55 GMT

Hello,

Can Security Essentials import security advisories from vendors like Broadcom or Microsoft?
I would like to compare those to our inventory and raise alerts if anything is affected by a security advisory.

Example:
import VMSA from Broadcom and compare against ESX, VM and vmTools that report into splunk.

Cheers
Andre

Re: import vendor security advisories for comparison with inventory

kiran_panchavat — Fri, 28 Mar 2025 04:12:40 GMT

@Andre_

Splunk Security Essentials (SSE) doesn’t natively import security advisories directly from vendors like Broadcom (VMSAs) or Microsoft out of the box. However, you can build this workflow using a combination of custom ingestion, lookups, correlation searches, and possibly a bit of automation.

Download security advisories (e.g., VMSA from Broadcom or Microsoft security bulletins) in a structured format like CSV, JSON, or text. For example, Broadcom’s VMware Security Advisories are available on their support portal (e.g., VMSA-2025-0004 for ESXi vulnerabilities). You could extract key details like CVE numbers, affected products, versions, and severity, then upload them as a lookup file in Splunk.

Write a custom script (e.g., in Python) to scrape or pull advisories from vendor APIs or RSS feeds (if available) and ingest them into Splunk via a scripted input or REST API.

Re: import vendor security advisories for comparison with inventory

Andre_ — Fri, 28 Mar 2025 04:59:15 GMT

thanks @kiran_panchavat
I was pretty sure its technically possible, but I'd be surprised if I were the first person trying to use Splunk to check an environment for applicable CVEs. So, kinds hoping I am not reinventing the wheel.