Is it possible to add CVSS vector information to Rapid7 App for Splunk Enterprise as additional vulnerability data imported into Splunk?

[ddavenpo]

I'm using the Rapid7 App for Splunk Enterprise ( https://splunkbase.splunk.com/app/1882/ ) to pull vulnerability data into Splunk. I would really like to add to what is imported. Specifically the CVSS base and temporal scores that Nexpose does appear to have, but the app doesn't choose to import. The Nexpose field I think that has it is "vm.cvss_vector" according to something I found here https://community.rapid7.com/thread/4195.

Has anyone modified the queries in /bin/nexpose_cim_data_generator.py to do something like this? I am not very good at Nexpose SQL queries...if anyone has figured this out and has any guidance it would be greatly appreciated!

Thanks!

[repeters · Accepted solution]

I have modified nexpose_cim_data_generator.py to include cvss_score at our site.

I think what you want will come from the dim_vulnerability table which is documented in the v6.4 Nexpose User Guide starting on page 494. The script already grabs a couple fields from that table, just not that one.

Basically, you need to update the vulnerability data CIM query that starts on line 75 in three places to include "dv.cvss_score" (the list of fields selected, the outer join against dv, and the group by clause)

Then you need to modify the printing of the header row further down (I added cvss_score to the end of the list), and update the csvreader loop to capture the new field and include it in each output row.

I don't have enough karma to attach a patch file for you, so here is the output from diff directly ... hopefully enough to get you started

$ diff nexpose_cim_data_generator.py.orig nexpose_cim_data_generator.py
75c75
<         query = """SELECT asset_id, da.ip_address, da.mac_address, site_id, favf.vulnerability_instances, favf.vulnerability_id, ds.finished, dv.title, dv.severity, dvc.categories, dve.skill_levels, dvr.sources, favf.scan_id
---
>         query = """SELECT asset_id, da.ip_address, da.mac_address, site_id, favf.vulnerability_instances, favf.vulnerability_id, ds.finished, dv.title, dv.severity, dvc.categories, dve.skill_levels, dvr.sources, favf.scan_id, dv.cvss_score
78c78
< LEFT OUTER JOIN (select dv.vulnerability_id, dv.title, dv.severity FROM dim_vulnerability dv) dv USING (vulnerability_id)
---
> LEFT OUTER JOIN (select dv.vulnerability_id, dv.title, dv.severity, dv.cvss_score FROM dim_vulnerability dv) dv USING (vulnerability_id)
84c84
< GROUP BY asset_id, da.ip_address, da.mac_address, ds.finished, site_id, favf.scan_id, favf.vulnerability_id, favf.vulnerability_instances, dv.title, dv.vulnerability_id, dv.severity, dvc.categories, dve.skill_levels, dvr.sources"""
---
> GROUP BY asset_id, da.ip_address, da.mac_address, ds.finished, site_id, favf.scan_id, favf.vulnerability_id, favf.vulnerability_instances, dv.title, dv.vulnerability_id, dv.severity, dv.cvss_score, dvc.categories, dve.skill_levels, dvr.sources"""
116c116
<                     "timestamp, most_recently_discovered,signature,bugtraq,category,cert,cve,dest,dest_ip,dest_mac_address,dvc,msft,mskb,product,severity,vendor,xref,vulnerability_instances,site_id,skill_level,other_references,signature_id".split(','))
---
>                     "timestamp, most_recently_discovered,signature,bugtraq,category,cert,cve,dest,dest_ip,dest_mac_address,dvc,msft,mskb,product,severity,vendor,xref,vulnerability_instances,site_id,skill_level,other_references,signature_id,cvss_score".split(','))
155a156
>                     cvss_score = row[13]
192a194
>                     cimRow.append(cvss_score)

[ddavenpo]

You are awesome @repeters! Exactly what I was looking for!