Predictive Models:
Metadata Model:
SBOM Updates
Fix done for NVD API updates released recently.
UI Changes
Data Coverage & Fixes
Debian CVE source ingested into the platform
Reddit - Enriched with more handles
Integrated with Twitter V2 API and added new handles
Train 3 brought back in Production Flows for Predictive Scores Comparison W/ Risk Index
Standardizing all the request input parameters of the vulnerability API
Added Risk Index to the list view and detailed view and can be viewed only if you have the required entitlement for it.
Single User ID (email-ID) provisioned with both UI and API Access
Changes to Detailed View – Posts/Discussions – Limit to Recent 10 + Show More
Weakness Module – Refreshed Mitre ranks, Added No of CVEs in List View
Added additional filters for plugins
Links in the footer updated with the right links
Counts added to all relevant filters and tabs in the detailed view
Column attributes in list view upon click navigates to the respective tabs with appropriate filters applied in detailed view
Added filter for reference tags
HackerPost discrepancies corrected
Timestamp format in API made consistent across all date fields
Nessus - Plugins from nbin files are also extracted in addition to nasl files and the data is now available in the platform
Nessus, Nexpose and Qualys - Deprecated plugins also handled
Few changes - Scanner name added to the sources list, published date of a cve changes, source name corrected for Qualys threats.
NVD Feeds to API : NVD feeds are now switched to API for both CVE and CPE.
Curated Threats : A new corpus for threats (in the wild) have been introduced where researchers can add threats as and when they come across and we need not wait for the source to be ingested to get this into the platform.
Modified Date removed for Github for CVE.
Temporal Metrics - Undefined renamed to Not Defined.
.
UI/API Changes
CVE - GitHub Advisories is being ingested into the platform.
Temporal Metrics - Coverage extended to Qualys, Nessus, PacketStorm and few rules modified.
2 additional threatWatch sources ingested
BaseScore, Impact Score, Exploitability score is now calculated in the platform from the available vector string. Not all sources were providing these scores.
Modified date is ignored from Scanner plugins for a CVE
Mcafee - Published dates refreshed.
UI/API Changes
Detailed View of Vulnerability Changes
Detailed Page - Right Panel - Indicators - On click takes the user to the corresponding tab
Alignment of tags under threats and sources in threats clickable
Timeline - Multiple events falling on the same date combined to one
References is now including all references for CVE, exploits, malware
Detailed Page - Right Panel - Predictive Indicators moved to separate line items
Securin Branding - The new color pallets and skins are now live.
Total CVE Widget - P-VRS Widget is also added new, the horizontal bars are changed to vertical and added legends. This is still with the old scores. Once train 2.1 is released ew can see the new scores reflecting.
Trends Screen - New Trends screen is developed with Mock Data and with the appropriate sort and filters views
Search button - Enabled with Enter key now in list and landing page.
Comprehensive API ( V2) is being switched with the new structural changes and UI is also modified to adhere to the new structure of the API.
List View - Tagging of new CVEs which came into the system past 24 hours and additional columns have been added - cvssv2, cvssv3 and no of exploits. Limited to <=7 columns at any point of time.
Detailed View - Vulnerability tags added for lastTrending and CISA.
Timeline Component - New time line component is added in the detailed view. This will be a growing list - To start off with we have - cvepublishedate, firstexploitseendate, maxcyratingdate and cisaddeddate plotted. Note: This detailed view is getting changed shortly.
Temporal Metrics V2 and V3 : This is now available in the detailed view under scores tab.
Advanced Search - Multi-Select enabled for attackClassifcation
Comprehensive API - Able to query based on viupdatedDate - Incremental enabled. Please note backend changes for the predictive side is not yet completed for the updatedDate. The Limit of the rows to be queried in one shot is modified from 50 to 100 now.
Stats API - This is enhanced to include the body parameters so that we know what users are querying on.
Ransomware Details corrected in the detailed view. Previously it was including all malware types
Exploit Widget - Attack Classification is now by order of precedence - RCE, PE, DoS, WebApp, Other
The vendor overview - numbers are clickable now
Ux Minor corrections as per the feedback from the Ux team - https://docs.google.com/spreadsheets/d/1ZLjolXO2P6QS9S1jDaVFdQS40LtoBEOV10OYqM_-Nx4/edit#gid=0
Sidekick issues with respect to Firefox and cache resolved
Data Coverage - Scanners - Scanner pipeline has been established and Plugin Information is extracted from the scanners Nessus and Qualys and is associated with the vulnerability view in the pipeline.
Comprehensive API - Plugin data is now exposed as part of comprehensive API and also within Posts - Author field is newly introduced. This is populated newly in the pipeline jobs.
All APIs - Increased the session timeout from 24 hrs to 7 days now. This is applicable across all APIs and with UI as well. This will also give enough time for new users to set up within 7 days.
Microsoft Threats - We identified a few gaps as not every version in Microsoft is active all the time. So we manually fed those additional old versions for better coverage.
Auto-labeling changes - Included threat behavior also to compute the autolabel for microsoft threats to get more accurate results.
CVSS changes for attack Vector (ADJACENT and ADJACENT_NETWORK) to match NVD standards and its corresponding VRS changes.
Additional Websites added - Deep & Dark Web (1 - Forum, 3- Repos) and 1 clearnet site.
Threat Coverage - Added additional sources for threats - McAfee [Exploit Kits]
Additional Websites added for Deep & Dark Web (1)
Landing Page - CVE Distribution - By Severity - The widget has been enhanced to accommodate the severity levels
Vulnerabilities - List View - This has been enhanced to include the download of CVEs along with the key attributes in the list view and the select column menu where the user can select columns to display in the list view.
Sidekick - Additional option - CVE Analysis introduced to extract close to 50+ attributes for the CVEs being provided by the user. This is going to help the research team on any analysis of the vulnerabilities that are ingested into the system.
Sidekick - View Results - Apart from the downloading the results to a file, user can also view the CVEs in the list view using the view result option.
API - Beta API with the structural changes is completed ( changes possible at the API end) and the API documentation is also updated in the UI.
Definitive VRS - Scoring - VRS algorithm is migrated to CSW platform and is also now getting calculated for CVEs where CNAs provide the attributes when it is missing from NVD. This also includes access complexity change in the algorithm from medium to low.
Threat Coverage - Added additional sources for threats - Exploits & Malware - Microsoft
POC and PentesterFramework tags added as part of the threat view and flags set accordingly.
Software_CPE - CPE official dictionary collection is created and a elastic view with its corresponding CVEs and its important attributes is created so that we can query based on CPEs directly. Deprecated CPEs along with the deprecated by information is also provided so that we get to know the new CPE (if any) if it is deprecated. Whenever a CPE or CVE information is getting updated, this view will also get refreshed.
Temporal Metrics V2 and V3 - Temporal metrics is now available under CVSSv2 and CVSSv3 for all CVEs as per the respective standards and is present as part of the Beta API.
Few bug fixes - Corrected the source of NVD to US-NVD, description field, CPE cache issues CWE removal, Core Security duplicates and Auto-label algorithm fixes.
Comprehensive API with structural changes (70% complete) suggested by the product is available in the Beta version of the API -https://apigargoyle.com/v1/vulnerabilities/rankings/comprehensive/beta. Once we have the new domains in place we can switch to that completely along with the UI integration. Documentation is pending for this. Please note that the backend changes in unifying the data are still pending for the new fields. We will get there by Q4.
Landing Page - Summary of all the counts - This is live data now, previously we had mock data. Search bar also introduced where the user can search on CVE id from the landing page itself.
Landing Page - Total CVEs Widgets
CVE distribution by CVSS Severity and VRS Severity - Rows are made clickable and opens up the list view with the appropriate filters.
CVE Distribution - D-VRS vs CVSS - Each cell is made clickable and opens up the list view with the appropriate filters.
Landing Page - Exploit Widgets
CVE distribution by Attack classification - Rows are made clickable and opens up the list view with the appropriate filters.
Top 10 CVEs by no of Exploits - Each CVE is clickable and opens up the detailed view of the CVE in the list view with the exploit filter set. View more options also takes the user to the list view with the appropriate filters
Landing Page - CISA KEVs Widgets
Newly added CVEs - Lists out the CVEs that were published by CISA in the past 24 hours, past week and past month. CVE is clickable which takes the user to the detailed view of the CVE in the list view
CISA KEVs by D-VRS - List the top CVEs in CISA sorted by Definitive VRS. The view more option takes the user to the list view with the appropriate filters.
Landing Page - Affected Vendors Widgets
Vender Overview - Drop down list of the vendors which gives the funnel of total CVEs, weaponized, RCE/PE and trending. It also gives the count of CVEs having Ransomware, part of CISA KEVS, and threat actors. Each of these icons /tabs are clickable taking it to the appropriate list view. Weaponized alone is pending.
Top Vendors by Vulnerabilities - Lists out the top 10 vendors by vulnerability count and also list the most vulnerable product. Each row is made clickable and opens up the list view with the appropriate filters.
Landing Page - Ransomware - Widget - List the top CVEs by ransomware associations - Each CVE is clickable and opens up the detailed view of the CVE in the list view with the ransomware filter set. View more options also takes the user to the list view with the appropriate filters
Landing Page - Trending CVEs (Widget 1 is mock data) - Widget 2 - Top Trending CVEs by definitive VRS - Each CVE is clickable and opens up the detailed view of the CVE in the list view with the ransomware filter set. View more options also takes the user to the list view with the appropriate filters
Landing Page - ThreatActors - Widget - List the top CVEs by threatActor counts - Each CVE is clickable and opens up the detailed view of the CVE in the list view with the threatActor filter set. View more options also takes the user to the list view with the appropriate filters
List View and Detailed View - icons are clickable now which opens up the respective tabs in the detailed view of the CVE.
Advanced Search feature enhanced
Malware Names - Ransomware name suggestions show up in the UI while the user starts typing in and user can search on a particular ransomware.
ThreatActors - ThreatActor name suggestions show up in the UI while the user starts typing in and user can search on a particular threatActor.
CVSS filter added in list view
Login - Removed the text and call feature.
Data Coverage - [CVE] - Vulnerability Information is now being extracted from more CNA sources - Cisco, Samsung, Apple and Qualcomm
Threat Coverage - Added additional sources for threats - Canvas.
Data Coverage - [CVE] - Vulnerability Information is now being extracted from the CNA sources - Microsoft - 9033 CVEs, RedHat - 27315 CVEs. New streaming architecture and Parsers built in the platform for this so that the data flows in real time and not in batch.
Threat Coverage - Added additional sources for threats - CoreSecurity. There was an additional de-duping logic that was also implemented which would be useful in removing the duplicates in the upcoming threat sources as well. Next to be released will be Microsoft threats.
API & UI - Changes to accommodate the additional information from CNAs
List View of all vulnerabilities with Filters on
Vulnerability Tags - CISA, Trending
Definitive and Predictive VRS range
Definitive Indicators - Exploits, Ransomware, Threat Actor
Predictive Indicators
Patch Availability
Sort capabilities on
CVE id
Definitive VRS
Predictive VRS
CVSS
No of Threats - Exploit count + Ransomware Count.
Search capabilities on
CVE id(s)
Published time period
Attack-classification - RCE, PE, WebApp, DoS and Other
Vendor and Product. A new Product-Vendor API is being developed where the Vendor and Product suggestions show up in the UI while the user starts typing in.
Detailed View of the CVE which shows the description, Affected Vendors, Indicators and has the below additional tabs to show more details about that vulnerability.
Scores tab - CVSSV2, CVSSV3 & Temporal Metrics, VRS
Changelog trends for Predictive Score - Shows the graph and model which led to the derivation of the score.
Definitive details - More details on the Exploits, Ransomware and Threat Actors for that vulnerability.
Predictive details which was part of Cyr3con already - Hacker discussions, POCs, Pen tester Frameworks, Exploits in the wild.
Weaknesses
Affected platform
Patch availability and references which was part of Cyr3con data already.
Login Flow
Users can login with their email id now for both API and Users.
2FA flow enabled - TOTP, Send Mail, Send Call, Send Text (For US customers only for now)
Forgot Password flow with the direct link to Reset Password page.
Settings for Change Password. Please note the New user set up flow is pending and for now Admin can be thru the old UI only. This is planned for Q3.
Sidekick and Software CPE - User can input their own CVEs in a csv file and will be able to download few details of those CVEs and view the history of the requests made as well.
Landing Page displaying the counts and widgets for Ransomware and ThreatActors with mock data.
Documentation of the Comprehensive API available in the UI.
Base VRS - Predictive Score for all CVEs
Components changed to pull in all CVEs that do not have mentions to assign a base score of 1. This would be enhanced in Q3 with multiple tweaks and changes in the model to assign the score as per the models.
Point worth mentioning here is a UAT test environment has been set up newly which would split the whole pipeline into 6 phases where snapshots of each phase can be taken and restored through scripts. This will help save a lot of time as we can resume at the phase which has any issues rather than running the whole set up all the time