Skip to content

Vulnerability Finding (2002)

The Vulnerability Finding event is a notification about weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

  • Category: Findings
  • Extends: finding
  • UID: 2002

Attributes

Section titled “Attributes”

Classification

Section titled “Classification”

activity_id

  • Type: integer_t
  • Requirement: required
  • Values:
    • 0 - Unknown: The event activity is unknown.
    • 1 - Create: A finding was created.
    • 2 - Update: A finding was updated.
    • 3 - Close: A finding was closed.
    • 99 - Other: The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.

The normalized identifier of the finding activity.

category_uid

  • Type: integer_t
  • Requirement: required
  • Values:
    • 2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.

The category unique identifier of the event.

class_uid

  • Type: integer_t
  • Requirement: required
  • Values:
    • 2002 - Vulnerability Finding: The Vulnerability Finding event is a notification about weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

The unique identifier of a class. A Class describes the attributes available in an event.

severity_id

  • Type: integer_t
  • Requirement: required
  • Values:
    • 0 - Unknown: The event/finding severity is unknown.
    • 1 - Informational: Informational message. No action required.
    • 2 - Low: The user decides if action is needed.
    • 3 - Medium: Action is required but the situation is not serious at this time.
    • 4 - High: Action is required immediately.
    • 5 - Critical: Action is required immediately and the scope is broad.
    • 6 - Fatal: An error occurred but it is too late to take remedial action.
    • 99 - Other: The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.

The normalized identifier of the event/finding severity.The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.

type_uid

  • Type: long_t
  • Requirement: required
  • Values:
    • 200200 - Vulnerability Finding: Unknown
    • 200201 - Vulnerability Finding: Create: A finding was created.
    • 200202 - Vulnerability Finding: Update: A finding was updated.
    • 200203 - Vulnerability Finding: Close: A finding was closed.
    • 200299 - Vulnerability Finding: Other

The event/finding type ID. It identifies the event’s semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.

activity_name

  • Type: string_t
  • Requirement: optional

The finding activity name, as defined by the activity_id.

category_name

  • Type: string_t
  • Requirement: optional

The event category name, as defined by category_uid value: Findings.

class_name

  • Type: string_t
  • Requirement: optional

The event class name, as defined by class_uid value: Vulnerability Finding.

severity

  • Type: string_t
  • Requirement: optional

The event/finding severity, normalized to the caption of the severity_id value. In the case of ‘Other’, it is defined by the source.

type_name

  • Type: string_t
  • Requirement: optional

The event/finding type name, as defined by the type_uid.

Context

Section titled “Context”

metadata

The metadata associated with the event or a finding.

confidence_id

  • Type: integer_t
  • Requirement: recommended
  • Values:
    • 0 - Unknown: The normalized confidence is unknown.
    • 1 - Low
    • 2 - Medium
    • 3 - High
    • 99 - Other: The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.

The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature.

status_id

  • Type: integer_t
  • Requirement: recommended
  • Values:
    • 0 - Unknown: The status is unknown.
    • 1 - New: The Finding is new and yet to be reviewed.
    • 2 - In Progress: The Finding is under review.
    • 3 - Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed.
    • 4 - Resolved: The Finding was reviewed, remediated and is now considered resolved.
    • 99 - Other: The event status is not mapped. See the status attribute, which contains a data source specific value.

The normalized status identifier of the Finding, set by the consumer.

api cloud

  • Type: api
  • Requirement: optional

Describes details about a typical API (Application Programming Interface) call.

comment

  • Type: string_t
  • Requirement: optional

A user provided comment about the finding.

confidence

  • Type: string_t
  • Requirement: optional

The confidence, normalized to the caption of the confidence_id value. In the case of ‘Other’, it is defined by the event source.

confidence_score

  • Type: integer_t
  • Requirement: optional

The confidence score as reported by the event source.

enrichments

The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:[{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

raw_data

  • Type: string_t
  • Requirement: optional

The raw event/finding data as received from the source.

status

  • Type: string_t
  • Requirement: optional

The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of ‘Other’, it is defined by the source.

unmapped

  • Type: object
  • Requirement: optional

The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

Occurrence

Section titled “Occurrence”

time

  • Type: timestamp_t
  • Requirement: required

The normalized event occurrence time or the finding creation time.

timezone_offset

  • Type: integer_t
  • Requirement: recommended

The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.

count

  • Type: integer_t
  • Requirement: optional

The number of times that events in the same logical group occurred during the event Start Time to End Time period.

duration

  • Type: integer_t
  • Requirement: optional

The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.

end_time

  • Type: timestamp_t
  • Requirement: optional

The time of the most recent event included in the finding.

end_time_dt datetime

  • Type: datetime_t
  • Requirement: optional

The time of the most recent event included in the finding.

start_time

  • Type: timestamp_t
  • Requirement: optional

The time of the least recent event included in the finding.

start_time_dt datetime

  • Type: datetime_t
  • Requirement: optional

The time of the least recent event included in the finding.

time_dt datetime

  • Type: datetime_t
  • Requirement: optional

The normalized event occurrence time or the finding creation time.

Primary

Section titled “Primary”

cloud cloud

  • Type: cloud
  • Requirement: required

Describes details about the Cloud environment where the event was originally created or logged.

finding_info

Describes the supporting information about a generated finding.

vulnerabilities

This object describes vulnerabilities reported in a security finding.

message

  • Type: string_t
  • Requirement: recommended

The description of the event/finding, as defined by the source.

resource

Describes details about the resource that is affected by the vulnerability/vulnerabilities.

actor host

  • Type: actor
  • Requirement: optional

The actor object describes details about the user/role/process that was the source of the activity.

device host

  • Type: device
  • Requirement: optional

Describes the affected device/host. It can be used in conjunction with Affected Resource(s).

e.g. Specific details about an AWS EC2 instance, that is affected by the Finding.

observables

The observables associated with the event or a finding.

status_code

  • Type: string_t
  • Requirement: optional

The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of ‘Failure Code’, e.g. 0x18.

status_detail

  • Type: string_t
  • Requirement: optional

The status details contains additional information about the event/finding outcome.

Objects Used

Section titled “Objects Used”