Exploit target#
Tip
This entity is analogous to these STIX objects:
An exploit target represents a vulnerability or a weakness in a software or hardware product or system, in a network, or in a configuration that enables a threat actor to use it as an entry point to access your assets and resources, and eventually to take control over them. Like a window that is left open upon leaving the house, it is a security hole in your ecosystem or infrastructure that malicious actors can leverage to get in and pursue their objectives.
Tip
The EclecticIQ exploit target entity is analogous to the STIX 2.1 Vulnerability SDO.
Create an exploit target by selecting:
In the side navigation bar + Create > Exploit target.
Or:
(Requires EclecticIQ Labs: Intelligence creation on the graph)
In the top navigation bar of a graph, select + and then Exploit target to create a draft entity.
Double-click to open the newly created draft entity to edit it.
Then, Configure this entity.
Configure#
The following sections the fields and options available.
Note
Required fields are marked with an asterisk (*).
General#
Field |
EIQ JSON field |
Description |
---|---|---|
Title* |
|
Descriptive title for this entity. See Titles and aliases. |
Analysis |
|
Long description. |
Confidence |
|
Characteristics#
Characteristics are properties on an entity that provide context for the intelligence indicated by this object.
The following are characteristics available for this entity:
Characteristics: Vulnerability#
Add one or more vulnerabilities to attach to this entity. Analogous to VulnerabilityType
Field |
EIQ JSON field |
Description |
---|---|---|
Title |
|
Title for this vulnerability. |
Is known |
|
Select this if the vulnerability is known, i.e. not a 0-day vulnerability. |
Is publicly acknowledged |
|
Select this if the vulnerability has been publicly acknowledged by the software vendor for the affected software product. |
Description |
|
Description of vulnerability. |
Source |
|
Source of vulnerability. |
Discovered date/time |
|
Date and time this vulnerability is discovered. |
Discovered date/time precision |
|
|
Published date/time |
|
Date and time this vulnerability is published. |
Published date/time precision |
|
|
CVE-ID |
|
Must conform to the format Also creates a new |
OSVDB-ID |
|
(Deprecated) Open Sourced Vulnerability Database (OSVDB) ID. |
In addition, you can set the following vulnerability properties:
Vulnerability: CVSS Score#
Set the CVSS score for this vulnerability. Analogous to CVSSVectorType.
Field |
EIQ JSON field |
Description |
---|---|---|
Overall score |
|
Overall CVSS score. Calculated using the NVD CVSSv2 calculator. Must be in format |
Base score |
|
Must be in format |
Base vector |
|
Must be in format |
Temporal score |
|
Must be in format |
Temporal vector |
|
Must be in format |
Environmental score |
|
Must be in format |
Environmental vector |
|
Must be in format |
Vulnerability: Affected software#
Describe the software product affected by this vulnerability.
All values here are used to construct the XML object set in
data.vulnerabilities[].affected_software[].properties_xml
.
Analogous to
AffectedSoftwareType.
Properties set here are also used to create
a product: <Product>|<Version>|<Update>
observable
with the affected
link name,
when this entity is published.
Set values for the following fields:
Product: Name of software product affected.
Edition: Edition of software.
Language: Language used in software.
Update: Is the software up to date?
Vendor: Vendor name for software.
Version: Version of software.
Device manufacturer: Manufacturer of device running affected software.
Device model: Model of device running affected software.
Device serial number: Serial number of device running affected software.
Device firmware version: Firmware version running on device.
Device system os: OS running on device.
Vulnerability: References#
Field |
EIQ JSON field |
Description |
---|---|---|
References |
|
Enter one or more URLs. |
Characteristics: Weakness#
Add one or more weaknesses. Analogous to WeaknessType.
Field |
EIQ JSON field |
Description |
---|---|---|
Description* |
|
Describe this weakness. |
CWE-ID |
|
Assign a CWE ID. |
Characteristics: Configuration#
Add one or more vulnerable configurations. Analogous to ConfigurationType.
Field |
EIQ JSON field |
Description |
---|---|---|
Description* |
|
Describe this vulnerable configuration. |
CCE-ID |
|
Assign a CCE ID. Also creates new |
Observables#
You can create one or more new observables and link it to the currently open entity by selecting + Observable under the Observables section.
Note
If an observable you create here matches an observable rule with an ignore action, it does not appear when the you publish the entity.
In the Add observable view that appears, fill out these fields:
Field |
EIQ JSON field |
Description |
---|---|---|
Type* |
|
See Observable types |
Link name* |
||
Values(s)* |
|
Enter one or more values. One observable is created per value. Values must be comma-separated, or newline-separated, but not both. |
Maliciousness* |
Relationships#
Add relationships to this entity by selecting + Add relationship.
See Relationships.
Meta#
The Meta section contains configuration options that allow you to attach descriptive data to the entity.
Field |
EIQ JSON field |
Description |
---|---|---|
Estimated threat start time |
|
Estimated start of threat. See Time values. |
Estimated threat end time |
|
Estimated end of threat. See Time values. |
Estimated observed time |
|
Estimated time threat was observed. See Time values. |
Half-life |
|
See Half-life. Select one of these options:
|
Tags |
|
See tags and taxonomies. |
Source* |
|
Select one source. |
Source reliability |
|
See source reliability. Options:
|
Information source#
Field |
EIQ JSON field |
Description |
---|---|---|
Description |
|
Description of information source. |
Identity |
|
Name of this information source |
Roles |
|
One or more information source roles. Possible values:
|
References |
|
One or more URLs. |
Data marking#
Descriptive metadata for entity.
Field |
EIQ JSON field |
Description |
---|---|---|
TLP |
|
Set a TLP color for this entity. |
Terms of use |
|
Free text field allowing you to attach terms of use to an entity. Analogous to TermsOfUseMarkingStructureType. |
Simple |
|
Free text field for attaching any text to an entity. Analogous to SimpleMarkingStructureType. |
Workflow#
Use options here to apply workflow options to this entity.
Field |
Description |
---|---|
Add to dataset |
Select this option to add this entity to one or more datasets on Publish. |
Manually enrich |
Run one or more enrichers on this entity on Publish. |
Save and publish#
Tip
For more information, see Draft and published entities.
Select Publish to create this entity, and make it available under + Create > Production > Published.
For more publishing options, select More and then one of these options:
Publish and new: Publish this entity, and start creating a new entity.
Publish and duplicate: Publish this entity, and start creating a new entity using all the values set for this entity.
Select Save draft to save this entity as a draft, and make it available under + Create > Production > Drafts. You must publish an entity to use it elsewhere on EclecticIQ Intelligence Center.
For more options while saving as a draft, select More and then one of these options:
Publish and new: Save this entity as a draft, and start creating a new entity.
Publish and duplicate: Save this entity as a draft, and start creating a new entity using all the values set for this draft entity.