On August 11, 2023, Cisco announced that Cisco SecureX will go end-of-life on July 31, 2024. The content in this Github repository will not be actively maintained following this announcement.

Vulnerabilities to SecureX Incidents

Workflow #0022

This workflow periodically checks for “Vulnerable Application Detected” events in Cisco Secure Endpoint. If events are found, the associated CVEs are checked to see if they meet the threshold configured in the workflow. If the threshold is met for at least one of the endpoint’s vulnerabilities, a SecureX incident is opened.

This workflow has been updated to use the new "SecureX Token" account key. For more information about this, please see this page. If you want to use legacy authentication, you can import an older version of the workflow.

GitHub

Change Log

Date Notes
Apr 13, 2021 - Initial release
Sep 10, 2021 - Updated to use the new system atomics
Sep 1, 2022 - Updated to support SecureX Tokens

See the Important Notes page for more information about updating workflows

Requirements

  • The following system atomics are used by this workflow:
    • Secure Endpoint - Get Events
    • Threat Response - Create Incident
    • Threat Response - Create Relationship
    • Threat Response - Create Sighting
  • The following atomic actions must be imported before you can import this workflow:
    • None
  • The targets and account keys listed at the bottom of the page
  • Cisco Secure Endpoint

Workflow Steps

  1. Calculate the time 24 hours ago
  2. While there are events to process:
    • Get events from Secure Endpoint
    • Convert the events to a table
    • Loop through each event:
      • Extract attributes from the event
      • Convert the list of vulnerabilities to text
      • Check if the CVE threshold was met. If it was, create the SecureX incident
    • Check if there’s another page of events
      • If there is, update the paging variables and continue
      • If there isn’t, end the workflow

Configuration

  • Set the CVE Score Threshold local variable to the minimum CVE score you want to generate incidents for. This is 6.5 by default
  • By default, the workflow is configured to run once a day using the 0022 - Secure Endpoint - Vulnerabilities to SecureX Incidents schedule. When you import the workflow, the schedule trigger will be disabled. To enable the schedule:
    • Open the workflow in the workflow editor
    • Scroll down to the Triggers section of the workflow’s properties and click Secure Endpoint Event Polling
    • Uncheck the Disable Trigger box and click Save
  • If you change the schedule for this workflow, you will need to adjust the Calculate time 24 hours ago activity’s Adjustment input variable to match the new schedule. As in, if you change the schedule to every 2 days, you would need to subtract 172800 seconds instead of 86400

Targets

Target Group: Default TargetGroup

Target Name Type Details Account Keys Notes
AMP_Target HTTP Endpoint Protocol: HTTPS
Host: api.amp.cisco.com
Path: /v1		 AMP_Credentials Created by default
Private_CTIA_Target HTTP Endpoint Protocol: HTTPS
Host: private.intel.amp.cisco.com
Path: None		 CTR_Credentials Created by default

Account Keys

Account Key Name Type Details Notes
AMP_Credentials HTTP Basic Authentication Username: Client ID
Password: Client Secret		 Created by default
CTR_Credentials SecureX Token   See this page