Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The First EPSS CDF for ThreatQ enables analysts to automatically ingest the EPSS (Exploit Prediction Scoring System) scores and the EPSS percentiles for a list of CVEs. The EPSS score represents the probability [0-1] of exploitation in the wild in the next 30 days. The percentile of the score represents the proportion of all scored vulnerabilities with the same or a lower EPSS score. The EPSS score and percentile are computed by FIRST, the global Forum of Incident Response and Security Teams.

The integration provides the following feeds:

• First EPSS Scores - ingests the EPSS scores and percentiles for a list of given CVEs.

The integration ingests indicators and indicator attributes.

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the OSINT option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   A List of Comma-separated CVEs	The CVEs for which the EPSS score and percentile should be ingested.
   Date	Set the date to from which to ingest the scores and percentiles. If this value is empty, the most recent values are ingested.  The format should be as follows: yyyy-mm-dd
   Minimum EPSS Score	Optional - Enter the minimum EPSS score to ingest the CVE.  Only CVEs with the minimum score or greater will be ingested.
   Minimum EPSS Percentile	Optional - Enter the minimum EPSS percentile to ingest the CVE.  Only CVEs with the minimum percentile or greater will be ingested.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
    "status": "OK",
    "status-code": 200,
    "version": "1.0",
    "access": "public",
    "total": 3,
    "offset": 0,
    "limit": 100,
    "data": [
        {
            "cve": "CVE-2022-26332",
            "epss": "0.000720000",
            "percentile": "0.294870000",
            "date": "2023-04-09"
        },
        {
            "cve": "CVE-2022-26315",
            "epss": "0.000860000",
            "percentile": "0.349110000",
            "date": "2023-04-09"
        },
        {
            "cve": "CVE-2022-26181",
            "epss": "0.000560000",
            "percentile": "0.215250000",
            "date": "2023-04-09"
        }
    ]
}

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Change Log

• Version 1.0.1
  • Updated the attributes ingested to be displayed as percentages.  
• Version 1.0.0
  • Initial release