Using Splunk for Asset Discovery in Vulnerability Management

[simuneer]

I am in Vulnerability Management and a novice Splunk user.  I want to create a query to quickly determine whether we possess any assets that could be affected when a critical CVE is released.    For example, if Cisco releases a CVE that affects Cisco Adaptive Security Appliance (ASA), I want to be able to run a query and quickly determine whether we possess any of the affected assets in our environment.

[PickleRick]

You can't search data you don't have. So first you have to ask yourself if you have any data regarding your assets in your Splunk and if you do, what kind of information it contains.

[gcusello]

Hi @simuneer,

your request isn't so easy to answer because there are many information missing:

• have you an asset list from your data (also from your Vulnerability Assessment tool)?
• have you a CVE list from a site (e.g. VulnDB) or a tool?
• have you a common key to correate your CVE list to the assets (e.g. OS)?

having the above information, it's possible and we developed this for one of our customer but it isn't a question for the Community but a project.

Ciao.

Giuseppe

[simuneer]

There are no logs coming in from a VMgmt tool, I'm simply being handed a Critical CVE and being told to search for any assets that match.  Right now, I'm just performing a very taxing search where "index=* sourcetype=* [insert something that might relate to the asset]"

[gcusello]

Hi @simuneer ,

as I said, if you have a CVE list (e.g. the one from VulDB) you can check the contents of the CVE with your data.

Otherwise, you have two solutions:

• you should identify the pattern to search (e.g. Log4J) in your logs and run a search containing these patternes,
• have an Asset Inventory and extract from the CVE the device classes to associate the CVE with your assets.

As I said, we implemented for a customer a connection with VulDB (it is a paid service), using an app from Spunkbase, and we developed an app to integrate these data with the Customer Asset Inventory.

Ciao.

Giuseppe

[PickleRick]

@gcuselloan off-topic question - were you able to do anything reasonable with the VulDB data? We tested the app for a while with one customer but it turned out the returned data was useless due to complete lack of any reasonable structure to it.

[gcusello]

Hi @PickleRick ,

we are receiving the messages from VulDB, we form them and we send to a customer External system.

Then we receive assets from their asset management and we compare them with the daily CVEs, there are two fields in the record layout to do this.

Ciao.

Giuseppe

[PickleRick]

We tried to do similar thing but we found the data from VulDB lacking in terms of precision. The vulnerability description was free-form text, sometimes there were affected versions of software mentioned, sometimes not...