Cyber Vulnerabilities

Event Time

active

required

boolean_t

VulnerabilityFinding.time: The normalized event occurrence time. For example: 1618524549901

CVE Base Score

cve_cvss_base_score

recommended

float_t

VulnerabilityFinding.vulnerabilities: This object describes vulnerabilities reported in a security finding. Vulnerability.cve: The Common Vulnerabilities and Exposures (CVE <https://cve.mitre.org/>_).

CVE Severity

cve_cvss_severity

recommended

string_t

VulnerabilityFinding.vulnerabilities: This object describes vulnerabilities reported in a security finding. Vulnerability.cve: The Common Vulnerabilities and Exposures (CVE <https://cve.mitre.org/>_).

CVE Version

cve_cvss_version

recommended

string_t

VulnerabilityFinding.vulnerabilities: This object describes vulnerabilities reported in a security finding. Vulnerability.cve: The Common Vulnerabilities and Exposures (CVE <https://cve.mitre.org/>_).

CVE Description

cve_description

optional

string_t

VulnerabilityFinding.vulnerabilities: This object describes vulnerabilities reported in a security finding. Vulnerability.cve: The Common Vulnerabilities and Exposures (CVE). Cve.desc: A brief description of the CVE Record.

CVE References

cve_references

recommended

string_t

VulnerabilityFinding.vulnerabilities: This object describes vulnerabilities reported in a security finding. Vulnerability.cve: The Common Vulnerabilities and Exposures (CVE). Cve.references: A list of reference URLs with additional information about the CVE Record.

CVE Type

cve_type

recommended

string_t

VulnerabilityFinding.vulnerabilities: This object describes vulnerabilities reported in a security finding. Vulnerability.cve: The Common Vulnerabilities and Exposures (CVE <https://cve.mitre.org/>_).

CVE UID

cve_uid

required

string_t

SecurityFinding.vulnerabilities: This object describes vulnerabilities reported in a security finding. Vulnerability.cve: The Common Vulnerabilities and Exposures (CVE <https://cve.mitre.org/>_).

Device ID

device_id

required

integer_t

VulnerabilityFinding.device_id: This is the id that DataBee uses to link this to a specific device.

First Seen Time

first_seen_time

optional

timestamp_t

VulnerabilityFinding.start_time: The time of the least recent event included in the finding.

ID

id

required

integer_t

VulnerabilityFinding.vulnerabilities: This object describes vulnerabilities reported in a security finding. Vulnerability.cve: The Common Vulnerabilities and Exposures (CVE <https://cve.mitre.org/>_).

Last Seen Time

last_seen_time

optional

timestamp_t

VulnerabilityFinding.end_time: The time of the most recent event included in the finding.

Exploit Available

is_exploit_available

optional

boolean_t

VulnerabilityFinding.vulnerabilities: This object describes vulnerabilities reported in a security finding. Vulnerability.is_exploit_available: Indicates if an exploit or a PoC (proof-of-concept) is available for the reported vulnerability.

Record Created At

record_created_at

required

timestamp_t

CDPs generated timestamp when record was created.

Record Updated At

record_updated_at

required

timestamp_t

CDPs generated timestamp when record was last updated.

Application Vendor Name/Application Version/Application Name/Application Unique ID

software_application_id

required

integer_t

ApplicationLifecycle.app: The application that was affected by the lifecycle event.  This also applies to self-updating application systems. Product.vendor_name: The name of the vendor of the product. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.version: The version of the product, as defined by the event source. For example: 2013.1.3-beta. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.name: The name of the product. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.uid: The unique identifier of the product.

Data Sources

sources

required

string_t Array

VulnerabilityFinding.metadata_: The metadata associated with the event or a finding. Metadata.product: The product that reported the event.

Title

title

required

string_t

VulnerabilityFinding.finding_info: Describes the supporting information about a generated finding. FindingInfo.title: A title or a brief phrase summarizing the reported finding.

Unique ID

uid

required

string_t

VulnerabilityFinding.finding_info: Describes the supporting information about a generated finding. FindingInfo.uid: The unique identifier of the reported finding.

User ID

user_id

required

integer_t

VulnerabilityFinding.user_id: This is the id that DataBee uses to link this to a specific user.

Vendor Description

vendor_description

optional

string_t

VulnerabilityFinding.finding_info: Describes the supporting information about a generated finding. FindingInfo.desc: The description of the reported finding.

Vendor Type

vendor_type

optional

string_t

VulnerabilityFinding.finding_info: Describes the supporting information about a generated finding. FindingInfo.types_: One or more types of the reported finding.

Severity

vulnerability_severity

optional

string_t

VulnerabilityFinding.vulnerabilities: This object describes vulnerabilities reported in a security finding. Vulnerability.severity: The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.