Vulnerabilities

APIs for managing vulnerabilities

Get list of vulnerabilities

post

Get a list of vulnerabilities that match the filter fields. The list includes key information about each vulnerability.

Required license: Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on.

Body

Responses

200

OK

application/json

401

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.

application/json

500

Internal server error. A unified status for API communication type errors.

application/json

post/public_api/uvem/v1/get_vulnerabilities

POST /public_api/uvem/v1/get_vulnerabilities HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 206

{
  "request_data": {
    "filters": [
      {
        "field": "attack_vector",
        "operator": "text",
        "value": "text"
      }
    ],
    "sort": {
      "field": "text",
      "keyword": "asc"
    },
    "search_from": 0,
    "search_to": 1,
    "use_page_token": true,
    "next_page_token": "text"
  }
}

{
  "reply": {
    "result_count": 1,
    "total_count": 1,
    "vulnerabilities": [
      {
        "vulnerability_id": "text",
        "epss_score": null,
        "cvss_score": 1,
        "cvss_severity": "text",
        "package_names": [
          "text"
        ],
        "vendors": [
          "text"
        ],
        "distribution_and_releases": [
          "text"
        ],
        "cisa_kev": null,
        "cvss_severity_source": "text",
        "cvss_score_source": "text",
        "first_published": 1,
        "last_modified": 1,
        "reported_exploited_by": [
          {}
        ],
        "attack_vector": "text",
        "cvss_version": "text"
      }
    ],
    "next_page_token": "text"
  }
}

Get vulnerability details

get

Get detailed information about a specific vulnerability.

For example, the following request retrieves detailed information about CVE-2021-28799: https://api-{{fqdn}}/public_api/uvem/v1/vulnerabilities?vulnerabilityId=CVE-2021-28799

Required license: Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on.

Query parameters

vulnerabilityIdstringRequired

Vulnerability ID

Example: CVE-2023-1234

Header parameters

authorizationstringRequired

api-key

Example: {{api-key}}

x-xdr-auth-idstringRequired

api-key-id

Example: {{api_key_id}}

Responses

200

OK

application/json

descriptionstringOptional

epss_scorenumberOptional

fixVersionsstringOptional

isKevbooleanOptional

vulnerabilityIDstringOptional

get/public_api/uvem/v1/vulnerabilities

GET /public_api/uvem/v1/vulnerabilities?vulnerabilityId=CVE-2023-1234 HTTP/1.1
Host: api-yourfqdn
authorization: {{api-key}}
x-xdr-auth-id: {{api_key_id}}
Accept: */*

200

OK

{
  "cvss": {
    "baseScoreMetrics": {
      "attackComplexity": "text",
      "attackVector": "text",
      "availabilityImpact": "text",
      "confidentialityImpact": "text",
      "integrityImpact": "text",
      "privilegesRequired": "text",
      "scope": "text",
      "userInteraction": "text"
    },
    "score": 1,
    "scoreSource": "text",
    "severity": "text",
    "severitySource": "text",
    "vectorString": "text",
    "version": "text"
  },
  "description": "text",
  "epss_score": 1,
  "exploitDetails": {
    "commercialExploitFound": true,
    "exploitMaturity": "text",
    "firstReportedThreatActor": 1,
    "mostRecentReportedThreatActor": 1,
    "publicExploitFound": true,
    "reportedExploited": true,
    "reportedExploitedByBotnets": true,
    "reportedExploitedByRansomware": true,
    "reportedExploitedByThreatActors": true,
    "weaponizedExploitFound": true
  },
  "fixVersions": "text",
  "isKev": true,
  "temporalCvss": {
    "confidence": "text",
    "score": 1,
    "vectorString": "text",
    "version": "text"
  },
  "vulnerabilityID": "text"
}