Security

CVSS 3.1 calculator in SPL [Solution]

NikoT
Engager

Hi all,

not a question, just an attempt to save other ppl some time. We had the need of calculating the score of CVSS3.1 Vector strings. We first used an external python script but that comes with a cost. Hence I decided to implement a cvss calculator in SPL.

It's already tested against a wide range of vector strings and seems pretty robust. 

here is what we created as a macro named `cvss31`

https://github.com/niko31337/splcvss31/blob/main/cvss31.macro

to call the macro and get the relevant fields, you do something like this:

 

 

 

| makeresults
| eval cvss_vector_string="CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C/CR:M/IR:M/AR:H/MUI:R"
`cvss31`
| table cvss_vector_string, main_score, main_rating, base_score, temporal_score, environmental_score, cvss_error

 

 

 

and you end up with this result:
cvss_calc.png


Make sure you always check for errors in the cvss_error field...
cvss_error.png

cheers,

Niko

 

Labels (1)
Tags (1)
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...