Intelligence Module - Vulnerability Prioritization

id

string

CVE-2024-12345

The CVE ID.

details

object

{ "vulnerability_name": "Acme Inc Expoilt Attempt", "vulnerability_description": "Potentially allowing Acme Inc to exploit anvil drop on new users.", "cve_cvss_score": 4.5, "product": "Acme Inc", "vendor": "Anvil Drop", "published_to_nist_nvd": true }

Basic CVE details, including CVSS score (Common Vulnerability Scoring System), associated products & vendors, and NIST CVE recognition status.

details.vulnerability_name

string

Acme Inc. Exploit Attempt

Name of the vulnerability.

details.vulnerability_description

string

Potentially allowing Acme Inc to exploit anvil drop on new users."

Description of the vulnerability.

details.cve_cvss_score

float

4.5

Current CVSS score (Common Vulnerability Scoring System).

details.product

string

Acme Inc

Product(s) associated with the CVE.

details.vendor

string

Anvil Drop

Vendor(s) associated with the CVE.

details.published_to_nist_nvd

boolean

true

Whether this CVE is recognized by NIST.

timeline

object

{ "cve_published_date": "2024-05-28T19:15:10.060", "cve_last_updated_date": "2024-05-31T16:04:09.703", "first_known_published_date": "2024-05-27T00:00:00Z", "cisa_kev_date_added": "2024-05-30T00:00:00Z" }

Key timeline details about when the CVE was published, updated, and added to CISA (https://www.cisa.gov/known-exploited-vulnerabilities-catalog).

timeline.cve_published_date

datetime

2024-05-28T19:15:10.060

Date when the CVE was published by NVD.

timeline.cve_last_updated_date

datetime

2024-05-31T16:04:09.703

Date when the CVE record was last updated.

timeline.first_known_published_date

datetime

2024-05-27T00:00:00Z

Date when the first exploit associated with the CVE was published.

timeline.cisa_kev_date_added

datetime

2024-05-30T00:00:00Z

Date CISA (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) added a KEV (Known Exploited Vulnerability) entry associated with the CVE.

exploitation_details

object

{ "attack_vector": "NETWORK", "exploit_found": true, "exploitation_registered_in_kev": true, "epss_score": 0.94504 }

Exploitation-related details pertaining to attack vector category, EPSS score (Exploit Prediction Scoring System), available exploits, and KEV (Known Exploited Vulnerabilities) registration.

exploitation_details.attack_vector

string

NETWORK

Attack vector category.

exploitation_details.exploit_found

boolean

true

Whether any known exploits are available.

exploitation_details.exploitation_registered_in_kev

boolean

true

Whether exploitation has been registered in the KEV (Known Exploited Vulnerabilities) database.

exploitation_details.epss_score

float

0.94504

EPSS score (Exploit Prediction Scoring System) associated with the exploitation.

exploitation_stats

object

{ "number_of_available_exploits": 60, "number_of_threat_actors_exploiting_vulnerability": 1, "number_of_botnets_exploiting_vulnerability": 0 }

Statistical data about exploitation, including number of exploits available, and number of threat actors and botnets exploiting the vulnerability.

exploitation_stats.number_of_available_exploits

integer

60

Total number of exploits available (public + commercial).

exploitation_stats.number_of_threat_actors_exploiting_vulnerability

integer

1

Total number of known threat actors exploiting the vulnerability.

exploitation_stats.number_of_botnets_exploiting_vulnerability

integer

0

Total number of botnets exploiting the vulnerability.

exploitation_activity

object

{ "activity_seen": true, "benign_ip_count_1d": 765, "benign_ip_count_10d": 765, "benign_ip_count_30d": 765, "threat_ip_count_1d": 0, "threat_ip_count_10d": 1, "threat_ip_count_30d": 14 }

Observed IPs scanning or exploiting the vulnerability today, in the last 10 days, and the last 30 days.

exploitation_activity.activity_seen

boolean

true

Whether GreyNoise has observed activity related to this CVE.

exploitation_activity.benign_ip_count_1d

integer

765

Total number of benign IPs GreyNoise observed scanning or exploiting this vulnerability today.

exploitation_activity.benign_ip_count_10d

integer

765

Total number of benign IPs GreyNoise observed scanning or exploiting this vulnerability in the last 10 days.

exploitation_activity.benign_ip_count_30d

integer

765

Total number of benign IPs GreyNoise observed scanning or exploiting this vulnerability in the last 30 days.

exploitation_activity.threat_ip_count_1d

integer

0

Total number of threat IPs GreyNoise observed scanning or exploiting this vulnerability today.

exploitation_activity.threat_ip_count_10d

integer

1

Total number of threat IPs GreyNoise observed scanning or exploiting this vulnerability in the last 10 days.

exploitation_activity.threat_ip_count_30d

integer

14

Total number of threat IPs GreyNoise observed scanning or exploiting this vulnerability in the last 30 days.