In this presentation, we talk about actual use cases that can be created in DNIF to leverage the additional information provided by vFeed based on attack CVEs and related CAPEC information. This presentation was demonstrated live during the DNIF Konnect session held on 4th July 2019 - You can watch the complete session here: https://youtu.be/owp1q-XoBoc?t=1170

1. © Copyright 2018 NETMONASTERY Inc
CVE Analysis using vFeed
1
NETMONASTERY Inc.

2. © Copyright 2018 NETMONASTERY Inc
- CVEs (Common Vulnerabilities and Exposures) provide a standard
identifier for a given vulnerability or exposure that could be used by
hackers as a stepping stone into a system or the network.
- DNIF with the help of vFeed help analyze CVEs using various functions
that help obtain additional information like CWE ID and CAPEC details.
Using vFeed with DNIF for CVE Analysis and Raising Tickets

3. © Copyright 2018 NETMONASTERY Inc 3
Query 1

4. © Copyright 2018 NETMONASTERY Inc
_fetch * from event where $Duration=7d AND $LogName=CHECKPOINT limit 1
>>_field $Keyword string “OpenSSL”
>>_lookup vfeed-pro keyword_to_cve $Keyword
>>_agg count_unique $CVE
DNIF Query

5. © Copyright 2018 NETMONASTERY Inc
- In the first line of the query we are fetching logs from the Checkpoint firewall for a
duration of seven days, for example purposes we are limiting the query result to only one
output.
- In the second line of the query we are looking to add a field called $Keyword and we
wish to add “OpenSSL” as the string value that should populate the field. (In this example
we have used the String value “OpenSSL” which exists in the Checkpoint Firewall logs,
this can also be done for string values that do not exist in the logs)
- In the third line of the query, we perform a lookup via vFeed Professional using the
function “keyword_to_cve “ for the inputs of the $Keyword field
- In the last line of the query we aggregate the unique CVEs obtained in the output as
shown in following screenshot
DNIF Query

6. © Copyright 2018 NETMONASTERY Inc

7. © Copyright 2018 NETMONASTERY Inc 7
Query 2

8. © Copyright 2018 NETMONASTERY Inc
_fetch * from event where $Duration=7d AND $LogName=CHECKPOINT limit 1
>>_field $Keyword string “Excel”
>>_lookup vfeed-pro keyword_to_cve $Keyword
>>_agg count_unique $CVE
DNIF Query

9. © Copyright 2018 NETMONASTERY Inc
- In this example, we have used the String value “Excel” which does not exist in the
Checkpoint Firewall logs. We can however still run a vFeed lookup for all the CVEs in
relation to the keyword “Excel”
DNIF Query

10. © Copyright 2018 NETMONASTERY Inc

11. © Copyright 2018 NETMONASTERY Inc 11
Query 3

12. © Copyright 2018 NETMONASTERY Inc
_fetch * from event where $Duration=7d AND $LogName=CHECKPOINT group
count_unique $CVE limit 10
DNIF Query

13. © Copyright 2018 NETMONASTERY Inc
- In this query we are fetching logs from the Checkpoint firewall for a duration of seven
days and we are grouping the CVEs by their unique counts.
- We then add a context menu that will help us deep dive into a particular CVE. By using
the context menu option, we ensure that any further analysis can be done by a simple
right click.
DNIF Query

14. © Copyright 2018 NETMONASTERY Inc

15. © Copyright 2018 NETMONASTERY Inc

16. © Copyright 2018 NETMONASTERY Inc

17. © Copyright 2018 NETMONASTERY Inc 17
Query 4

18. © Copyright 2018 NETMONASTERY Inc
_fetch * from event where $LogName=CHECKPOINT AND $Duration=30d group
count_unique $CVE , $LogName, $SrcIP, $AtkDesc limit 1
>>_lookup vfeed-pro get_cvss3_score $CVE
>>_checkif int_compare $VFCVSS3Base > 7 include
>>_raise module dnif_konnect high_severity_vulnerability_detected $CVE 4 12h
>>_trigger api freshdesk create_ticket High Severity Vulnerability detected : , $CVE ,
CVE.txt
DNIF Query

19. © Copyright 2018 NETMONASTERY Inc
DNIF Query
- In this query we are checking for Checkpoint firewall logs in the duration of 30 days. We
are grouping all the unique CVEs along with the log name, source IP and attack
description
- We are now running a lookup on vFeeds Professional where in we are retrieving the
CVSS3 details for the CVE
- Here we are checking and comparing if the CVSS3 base score is greater than 7 as the
scores that fall between 7 and 9 are categorized as high severity vulnerabilities. If they
satisfy the condition, we include the results in the next pipelined query.
- Based on the results of the earlier query, we raise the following module “High Severity
Vulnerability Detected”
- As the final step we go ahead and raise a ticket in Freshdesk from Freshworks using
the Freshdesk API

20. © Copyright 2018 NETMONASTERY Inc

21. © Copyright 2018 NETMONASTERY Inc

22. © Copyright 2018 NETMONASTERY Inc
Thank You
22