Security

CVSS 3.1 calculator in SPL [Solution]

NikoT
Engager

Hi all,

not a question, just an attempt to save other ppl some time. We had the need of calculating the score of CVSS3.1 Vector strings. We first used an external python script but that comes with a cost. Hence I decided to implement a cvss calculator in SPL.

It's already tested against a wide range of vector strings and seems pretty robust. 

here is what we created as a macro named `cvss31`

https://github.com/niko31337/splcvss31/blob/main/cvss31.macro

to call the macro and get the relevant fields, you do something like this:

 

 

 

| makeresults
| eval cvss_vector_string="CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C/CR:M/IR:M/AR:H/MUI:R"
`cvss31`
| table cvss_vector_string, main_score, main_rating, base_score, temporal_score, environmental_score, cvss_error

 

 

 

and you end up with this result:
cvss_calc.png


Make sure you always check for errors in the cvss_error field...
cvss_error.png

cheers,

Niko

 

Tags (1)
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...