Hello,
We are working on an SecOps Vulnerability Response opportunity where customers is looking for to import vulnerability entries from following sources:
What is the best way to do it?
Thx,
Marco
Hi,
A Vulnerable Item is a combination of a Vulnerability (sn_vul_entry) AND a Configuration Item (cmdb_ci). You need both parts to make a VI.
When you create a new VI manually it looks like this:
You need to provide a Vulnerability and a CI to successfully create a VI.
When you import data into Vulnerability Response you need to PROVIDE an actual Vulnerability and an actual Configuration Item.
For a Store Integration such as Tenable or Qualys, the incoming data is run through a lot of processing to identify and provide a valid Vulnerability and Configuration Item to create the Vulnerability.
VR by itself does not check anything. All of the checking (i.e. validation and matching) is done by the (Store) Integrations (Tenable, Qualys, Rapid7, etc.)
I see,
Are you talking about deduplication across vulnerability sources? If so, then no, VR does not attempt to duplicate across vulnerability sources.
If you are writing a custom integration and you have the latest VR version, you could check your open VIs -> Vulnerability -> CVEs to see if your main integration already has something open that contains a matching CVE. But this gets complicated fast.
