VulnCheck
Connector Category: API Feed Source
About VulnCheck
VulnCheck provides intelligence about known exploited vulnerabilities (KEV), enabling security analysts to make informed decisions to remediate vulnerabilities. This endpoint does not require a VulnCheck subscription to get intel about known exploited vulnerabilities (KEV).
Use Cases
Ingest known exploited vulnerabilities (KEV)
Retrieve vulnerability intelligence that predicts avenues of attack with speed and accuracy
Benefits
Utilize the vulnerability intelligence to remediate vulnerabilities proactively.
Configure VulnCheck as an API Feed Source
Configure VulnCheck as an API feed source in Intel Exchange to retrieve known exploited vulnerability feeds.
Before you Start
Ensure that you have View API Feed, View Feed Source, Create Feed Source, and Update Feed Source permissions.
Steps
To configure a VulnCheck as an API feed source, follow these steps:
Go to Administration > Integration Management > FEED SOURCES > APIs.
Click Add API Source.
Search and select the VulnCheck app.
Click Add Instance.
Enter a unique name to identify the instance. For example, Prod-VulnCheck.
Enter the base URL of your VulnCheck instance. The default base URL is
https://api.vulncheck.com/v3/index/.(Optional) Enter the bearer token to authenticate communication between the Intel Exchange and VulnCheck servers.
Select Verify SSL to verify the SSL certificate and secure the connection between the Intel Exchange and VulnCheck servers. By default, Verify SSL is selected.
Note
Cyware recommends you select Verify SSL. If you disable this option, Intel Exchange may configure an instance for an expired SSL certificate. This may not establish the connection properly and Intel Exchange will not be able to notify you in case of a broken or improper connection.
Click Save.
After the VulnCheck instance is configured successfully, you can view the VulnCheck feed channels. You can configure multiple instances by clicking Manage > Add More.
Configure VulnCheck Feed Channels
Configure the feed channels to retrieve threat data feeds from VulnCheck and store the feeds in a collection in Intel Exchange.
Steps
To configure a feed channel, follow these steps:
Go to Administration > Integration Management > FEED SOURCES > APIs.
Search and select the VulnCheck app.
Click the ellipsis on the top right corner and select Manage.
Click Manage Feed Channels.
Select a feed channel, and turn on the Enable toggle to enable the feed channel.
Enter the date and time to start polling feeds. Select a date within 15 days from the current date.
Enter the name of the collection to store the feed data. For example, KEV Feeds. Intel Exchange creates a collection with the specified name and stores all the feeds from the feed channel.
Select from one of the following Polling Cron Schedule types to define when to poll the data:
Manual: Allows you to poll from the source collection manually.
Auto: Allows you to automatically poll for threat intel from sources at specific time intervals. The default polling cron schedule is Auto. Enter a frequency in minutes between 60 and 10080 minutes in Polling Time. The default polling time is 240 minutes.
Set a default TLP and confidence score to assign to the feeds that do not have a TLP and confidence score already assigned. By default, the default TLP and confidence score are set to Amber and 100 respectively.
Select the tags to identify and categorize the feeds.
Click Save.
The feed channel is configured and you can poll feeds from the channel. You can enable the other feed channels, poll feeds, and view the feeds. For more information, see API Integrations.
Test VulnCheck Feed Channel Connectivity
Test the connectivity of the VulnCheck API feed channels to ensure that the connection with the correct API endpoint is established and that you have permission to poll feeds.
Before you Start
Ensure that the VulnCheck API integration is enabled.
Ensure that the feed channel is enabled to test the feed channel connectivity.
Steps
To test the connectivity of a feed channel, follow these steps:
Go to Administration > Integration Management > FEED SOURCES > APIs.
Search and select the VulnCheck app.
On a feed channel, click the vertical ellipses and select View Details.
Click Test Connectivity under Working Status.
If the connection is established, then the working status shows Working. If the connectivity testing results in an error, the working status shows a Connection Error. Hover over the tooltip next to Connection Error to view the error code.
Note
When the connectivity of a feed channel breaks, Intel Exchange disables the channel and re-attempts to restore the connectivity three times every hour. After a successful re-attempt to restore the connectivity, Intel Exchange enables the feed channel automatically.
To understand the error code and troubleshoot broken connectivity, see Troubleshoot Integrations.
VulnCheck Feed Channels
The following table lists all the feed channels and the VulnCheck API endpoints used for each feed channel.
Feed Channel | API URL |
|---|---|
VulnCheck Known Exploited Vulnerabilities (KEV) |
|