Configure and run the scheduled job for updating CWE records

Data imports from the CWE further enrich the vulnerability data in your instance. Use Common Weakness Enumeration (CWE) records downloaded from the CWE database for reference when deciding whether a vulnerability must be escalated. Run this integration as part of your initial setup of Vulnerability Response and prior to importing vulnerability data into your instance with a third-party scanner product.

Before you begin

Roles required: sn_vul.vulnerability_admin or sn_vul.admin (deprecated)

Persona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see Assign the Vulnerability Response persona roles using Setup Assistant. For more information about managing granular roles, see Manage persona and granular roles for Vulnerability Response.

Note:

Schedule the CWE update to run prior to the NVD database update. The default day for the NVD update is Weekly on Monday.

Update common weakness records from the Common Weakness Enumeration database on a regularly scheduled basis. You can also update the default script or write your own scripts, as needed.

Each CWE record also includes an associated knowledge article that describes the weakness. You cannot escalate a vulnerability from the Common Weakness Enumerations page.

• If you have the admin role, you can add repositories to the scheduled job.
• If you have sn_vul.vulnerability_read, you can execute the scheduled job.
• If you have sn_vul.vulnerability_write, you can edit the details of the scheduled job.

About this task

During integration execution, multiple processes are generated, and data is received in the form of pages. Each process can contain one or more import queue entries with attached data in pages. These entries must process the data within the one-hour time limit. However, if the payload size is large, the processing time may exceed one hour or get stuck, resulting in an integration timeout error. The integration continues to process the data despite the timeout error. To avoid this miscommunication, starting from version 18.2.4 of Vulnerability Response, timestamps (heartbeats) are sent periodically to indicate if the queue is active and processing data. The Last Record Processed field in the Import Queue Entry page is updated based on the count of records the import queue creates or updates. In case an import queue entry exceeds the one-hour time limit, the system checks the Last Record Processed field to see if it is also older than one hour. If it is, this indicates that the import queue entry is stuck, and it is timed out to prevent any further delays in processing.

Note:

The Last Record Processed field is updated based on what is defined in the following system properties:

• sn_sec_cmn.record_threshold_heartbeat: Defines the number of processed records, after which the heartbeat (timestamp) is sent to the import queue entry.
• sn_sec_cmn.maximum_heartbeat_delay: Defines the time after which the import queue entry must be timed out.

Procedure

1. Navigate to All > Vulnerability Response > Administration > Integrations.
2. Select the CWE Comprehensive 2000 Integration scheduled job.
3. Modify the fields, as needed.

   Table 1. Vulnerability Integration form

   Field	Description
   Name	Name of the scheduled job.
   Active	Whether the scheduled job is active. If you do not want the job to run for a specific time period, you can set up the parameters you want to use and deactivate the job.
   Run	Frequency you want the job to run. Subsequent fields are displayed or hidden based on your setting in this field. Note: The CWE update is On Demand by default. Set to a scheduled period that is prior to your NVD updates. Choices include: Daily: Choose a Time Weekly: (most common choice) Choose a Day andTime Monthly: Choose Day and Time Periodically: Choose a Repeat interval, Starting date and time Once: Choose a Starting date and time
   Day	The day you want the scheduled job to run. If you selected Weekly in the Run field, this field displays the days of the week. If you selected Monthly in the Run field, this field displays the days of the month. Note: Schedule the CWE update to run prior to the NVD database update. The default day for the NVD update is Weekly on Monday.
   Time	The time you want the scheduled job to start. Note: Schedule the CWE update to run prior to the NVD database update. The default time for the NVD update is 01:00:00
   Integration script	The script for pulling data from the data sources specified in the Data Sources related list.
   Source integration	[Read only]
   Source Instance	[Read only]
   Application	[Read only] The name of the application for which you are running the scheduled job.
   Repeat Interval	The number of days and hours before the scheduled job runs again. This field appears when Periodically is selected in the Run list.
   Starting	The date and time to start the periodic updates. This field appears when Periodically is selected in the Run list.
   Conditional	The check box to add conditional parameters.
   Condition	The conditions to run the schedule job. This field appears when Conditional check box is selected.
   Report processor strategy	The strategy for pulling data and processing the scheduled job. To pull data from the data sources in the Data Sources related list using the script in the Integration script field, select Data Source Attachment. To select a custom processor in the Report Processor script field, select the Custom Report Processor.
   Report processor	The script to be executed when the scheduled job runs. This field appears when Custom Report Processor is selected in the Report processor strategy list.
   Processor factory script	The script to build the report processor. This field appears when Custom Report Processor is selected in the Report processor strategy list.

4. Right-click in the header to Save your changes.
5. To run the scheduled job immediately, click Execute Now.
   You are returned to the Vulnerability Integrations view.
6. To watch the progress of the import, select the CWE Comprehensive 2000 Integration scheduled job again and select the Vulnerability Integration Runs tab.

   See View Vulnerability Response vulnerability libraries to see the imported entries.