Incoming feed - CVE Search API#

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.

Specifications

Transport type

CVE Search API

Content type

CVE Search JSON

Ingested data

CVE information about common software and hardware vulnerabilities, and exposures.

Processed data

Exploit target entities. The entity ID is derived from the CVE ID.

Description

Retrieve and process information on common software and hardware vulnerabilities, along with the corresponding exposures.

Configure the incoming feed#

  1. Create or edit an incoming feed.

  2. From the Transport type drop-down menu, select CVE Search API.

  3. From the Content type drop-down menu, select CVE Search JSON.
    The CVE Search API transport type supports only the CVE report JSON content type.
    The organization providing the source data for the incoming feed is the Computer Incident Response Center Luxembourg (CIRCL).

  4. The API URL field is automatically filled in with the default domain for the endpoint.
    You can add a proxy or set up ports according to your needs.
    Default value: https://cve.circl.lu.

  5. The SSL verification checkbox is automatically selected.

  6. In the Path to SSL certificate file field, you can enter the path to your PEM file.
    It is also possible to leave the field blank.

  7. To store your changes, click Save; to discard them, click Cancel.

By default, every time you run the feed, it ingests the most recent 30 CVE entries. Run this feed on a regular basis to keep up to date with the latest CVE definitions.

Test the feed#

  1. In the top navigation bar, click Data Configuration > Incoming feeds.

  2. Click the feed that you just created, using the steps above.

  3. In the Overview view, click Download now.

  4. Click Ingested entities and check that entities have been ingested into the platform.

Or:

  1. In the top navigation bar, click Intelligence > All intelligence > Browse.

  2. Click the Entities tab.

  3. In the top-left corner, click Filter.

  4. From the Source drop-down menu, select the incoming feed you have just created, using the steps.

  5. You can also filter also by entity type: from the Entity drop-down menu, select the entity types you want to include in the filtered results.