Security

CVSS 3.1 calculator in SPL [Solution]

NikoT
Engager

Hi all,

not a question, just an attempt to save other ppl some time. We had the need of calculating the score of CVSS3.1 Vector strings. We first used an external python script but that comes with a cost. Hence I decided to implement a cvss calculator in SPL.

It's already tested against a wide range of vector strings and seems pretty robust. 

here is what we created as a macro named `cvss31`

https://github.com/niko31337/splcvss31/blob/main/cvss31.macro

to call the macro and get the relevant fields, you do something like this:

 

 

 

| makeresults
| eval cvss_vector_string="CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C/CR:M/IR:M/AR:H/MUI:R"
`cvss31`
| table cvss_vector_string, main_score, main_rating, base_score, temporal_score, environmental_score, cvss_error

 

 

 

and you end up with this result:
cvss_calc.png


Make sure you always check for errors in the cvss_error field...
cvss_error.png

cheers,

Niko

 

Labels (1)
Tags (1)
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...