Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt

Use this file to discover all available pages before exploring further.

Get details on vulnerabilities by providing one or more IDs. The following permission is required to run this action:
  • Vulnerabilities: Read.
External DocumentationTo learn more, visit the CrowdStrike documentation.

Parameters

ParameterDescription
Vulnerability IDsA comma-separated list of vulnerability IDs. Can be obtained via the Search Vulnerabilities

Example Output

{
	"meta": {
		"query_time": 0.003279305,
		"powered_by": "spapi",
		"trace_id": "5ea98b6c-xxxx-xxxx-xxxx-9e0f11103eb4"
	},
	"resources": [
		{
			"id": "ca4944397d82410b8f8xxxxxxxxxx_de93270830eadc97b9e1796734af034c",
			"cid": "5ddbxxxxxxxxxxxxxxxxx75f17979a1f",
			"aid": "b1xxxxxxxxxxxxxxxxx8e09e9265a599",
			"vulnerability_id": "CVE-2017-8570",
			"vulnerability_metadata_id": "CS-V17-0757999",
			"data_providers": [
				{
					"provider": "CrowdStrike Spotlight"
				}
			],
			"created_timestamp": "2023-07-11T16:17:06Z",
			"updated_timestamp": "2023-08-03T17:39:49Z",
			"status": "open",
			"apps": [
				{
					"product_name_version": "Office 2013",
					"sub_status": "open",
					"remediation": {
						"ids": [
							"46147e49f3b636c5978b3134c822a11d"
						]
					},
					"evaluation_logic": {
						"id": "04eb0c6612593b35b8f1ee437c9bae64"
					}
				}
			],
			"suppression_info": {
				"is_suppressed": false
			},
			"app": {
				"product_name_version": "Office 2013"
			},
			"cve": {
				"id": "CVE-2017-8570",
				"base_score": 7.8,
				"severity": "HIGH",
				"exploit_status": 90,
				"exprt_rating": "CRITICAL",
				"remediation_level": "O",
				"cisa_info": {
					"is_cisa_kev": true,
					"due_date": "2022-08-25T00:00:00Z"
				},
				"spotlight_published_date": "2021-05-10T17:08:00Z",
				"actors": [
					"COBALT SPIDER",
					"GALACTIC OCELOT",
					"GOBLIN PANDA",
					"OCEAN BUFFALO",
					"VENOM SPIDER"
				],
				"description": "Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka \"Microsoft Office Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0243.\n",
				"published_date": "2017-07-11T07:00:00Z",
				"vendor_advisory": [
					"https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2017-8570",
					"https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8570"
				],
				"references": [
					"https://github.com/rxwx/CVE-2017-8570",
					"https://github.com/tezukanice/Office8570",
					"https://github.com/ParsingTeam/ppsx-file-generator",
					"http://www.securityfocus.com/bid/99445"
				],
				"exploitability_score": 1.8,
				"impact_score": 5.9,
				"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
			},
			"host_info": {
				"hostname": "BIG-BLUE-MACHINE",
				"local_ip": "192.168.0.30",
				"machine_domain": "",
				"os_version": "Windows 10",
				"ou": "",
				"site_name": "",
				"system_manufacturer": "Xen",
				"groups": [
					{
						"id": "1eb1xxxxxxxxxxxxxxxxxce2696995af",
						"name": "Windows Workstations"
					},
					{
						"id": "2399xxxxxxxxxxxxxxxxx40b186f4f94",
						"name": "Windows 10"
					}
				],
				"tags": [],
				"platform": "Windows",
				"instance_id": "i-004a7e4771430d2bd",
				"service_provider_account_id": "5xxxxxxxxxx6",
				"service_provider": "55xxxxxxxxxx6",
				"os_build": "18363",
				"product_type_desc": "Workstation",
				"asset_criticality": "Critical",
				"entity_graph_id": "445xxxxxxxxxx65139",
				"third_party_asset_ids": [
					"ServiceNow: 008125xxxxxxxxxx61491ecc139619b2"
				],
				"managed_by": "Falcon sensor",
				"host_last_seen_timestamp": "2023-07-30T00:00:00Z"
			},
			"remediation": {
				"ids": [
					"46147e49f3b636c5978b3134c822a11d"
				],
				"entities": [
					{
						"id": "46147e49f3b636c5978b3134c822a11d",
						"reference": "cpe:/a:microsoft:office::::",
						"title": "Update Microsoft Office",
						"action": "Update Microsoft Office to the latest available version",
						"link": "",
						"vendor_url": ""
					}
				]
			}
		}
	]
}

Workflow Library Example

Get Vulnerabilities with Crowdstrike and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop