Cisco Secure Endpoint - Get Vulnerability Summary for Assets

This incident response workflow fetches vulnerability information from Cisco Secure Endpoint for assets involved in an incident when triggered from a playbook or using an automation rule. When using this workflow in a playbook, vulnerability information is fetched for the assets selected by the user. When using this workflow with an incident automation rule, vulnerability information is fetched for all incident targets.

Description

Target: Secure Endpoint - v1

Steps:

Detect the start type and extract the supported observables
Check if any supported observables were found (if not, end the workflow)
For each observable:
- Check the observable's type:
  - If a Secure Endpoint computer GUID, set the local GUID variable
  - If a hostname or an IP address, search for it in Secure Endpoint and set the local GUID variable (if not found, skip the observable)
- Fetch the computer's details and CVEs and update the workflow result

This workflow requires the following targets to be available before it can be run.

Integration targets

Secure Endpoint

Author

Cisco

Version

v1.0

Intent

Incident Response

Integration

Secure Endpoint

Average rating

No ratings yet

Authorship

Cisco Managed

https://support.cisco.com

Content Licensing

Developer Community

Cisco Managed

This incident response workflow allows you to add hashes involved in an incident to a simple custom detection list in Cisco Secure Endpoint through a playbook or using an automation rule.

Community

# Cisco Secure Endpoint Exclusion List Export Workflow The Workflow will list exclusion lists of Cisco Secure Endpoint for validating and review.

Community

This workflow will list duplicate GUIDs in Cisco Secure Endpoint for validation and review.

Cisco Managed

This incident response workflow fetches vulnerability information from Cisco Secure Endpoint for assets involved in an incident when triggered from a playbook or using an automation rule.

Cisco Managed

This workflow appears in the pivot menu and allows you to request approval to isolate a host using Cisco Secure Endpoint.

Cisco Managed

This incident response workflow allows you to isolate hosts involved in an incident using Cisco Secure Endpoint from a playbook or using an automation rule.

Cisco Managed

This workflow appears in the pivot menu and will move the endpoint identified by the provided observable to a device group in Cisco Secure Endpoint.

Cisco Managed

This incident response workflow allows you to move computers to a group in Cisco Secure Endpoint from a playbook or using an automation rule.