Cyware Orchestrate

Perform the steps mentioned in the Search Collection action. For more information, see Action: Search Collection.

Paste the list of IDs that you copied from the Search Collection action into the value field in key-value format. The key must be one of the following: vulnerabilities, software, attack_ancestors, or actors, and the value must be the corresponding IDs. Perform this action using the following example payload:

{
    "filter": {
        "op": "and",
        "items": [
            {
               
                "op": "in",
                "field": "id_name", // Replace id_name with one of the following keys: vulnerabilities, software, attack_ancestors, actors
                "value": [
                    id_name -> value // Replace id_name with the chosen key and value with the list of IDs for that key
                ],
                "case_sensitive": false,
                "highlight": false
                            
            }
            
        ]
    },
    "analytic_compilation_target_id": 1,
    "format": [
        "json"
    ]
}

Replace id_name with the appropriate key based on the Search Collection action. For example, if you are using IDs related to vulnerabilities, set id_name to vulnerabilities and the value to the corresponding list of IDs.   

After performing these steps, you will receive a task_id for the analytics. You can use this task_id in the Export Analytics Status and Export Analytics Status Result actions to check the status and results of the specified analytics operation respectively.

Run this action without entering any values for the Operation and Items parameters. This will return the threat indicator types and their available values in key-value format. The possible threat indicator type keys are vulnerability_names, software_names, attack_names, and actor_names. For example, the response may include:

"vulnerability_names": [
                "CVE-2017-11882",
                "CVE-2018-0798",
                "CVE-2018-0802",
                "CVE-2012-0158",
                "CVE-2017-0199"
            ]

From the response, copy a value from one of the threat indicator types to use in the value field for items. Perform this action again using the following example payload:

{
    "op": "and",
    "items": [
        {
            "field": "visibility",
            "op": "in",
            "value": [
                "Published"
            ]
        },
        {
            "field": "text",
            "op": "contains",
            "value": "example_names", //Replace example_names with the copied value
            "case_sensitive": false,
            "highlight": true
        }
    ]
}

Replace example_names with the value you copied. For example, if you copied CVE-2017-11882, replace example_names with CVE-2017-11882.

You will receive IDs for the following keys: vulnerabilities, software, attack_ancestors, and actors.

Copy all the IDs from one of the keys and use them in the Export Analytics action to retrieve the list of analytics. For more information, see Action: Export Analytics.