Define Vulnerability

A vulnerability is a weakness or flaw in a software or hardware component that can be exploited by attackers to compromise confidentiality, integrity, or availability.

Before you begin

Role required: sn_sec_tisc.analyst

Procedure

1. Navigate to Workspaces > Threat Intelligence Security Center.

2. Select Threat Intel Library icon on the workspace.

3. Go to Vulnerability object.

4. Select New.

   Note:

   When you create a record for an observable, indicator, entity, or object, a corresponding source record is automatically generated. A confirmation message is displayed to indicate that the new object record is created, and you’re then redirected to the aggregated record.

5. On the form, fill in the fields.

|Field|Description|
|-----|-----------|
|CVSS 2.0 Base Score|The CVSS v2.0 base score for this vulnerability.|
|CVSS 3.x Base Score|The CVSS v3.0 / v3.1 base score for this vulnerability.|
|CVSS 4.0 Base Score|The CVSS v4.0 base score for this vulnerability.|
|CVSS 2.0 Vector|The CVSS v2.0 vector string representing the vulnerability characteristics.|
|CVSS 3.x Vector|The CVSS v3.x vector string representing the vulnerability characteristics.|
|CVSS 4.0 Vector|The CVSS v4.0 vector string representing the vulnerability characteristics.|
|EPSS Score|Exploit Prediction Scoring System \(EPSS\) score indicating the probability of exploitation.|
|EPSS Percentile|The percentile ranking of the EPSS score compared to all vulnerabilities.|

1. Select Save.

   After you save, a prompt message is displayed indicating that A new observable record is created. Select Continue to edit the record and create new relationships.

2. Select Continue.

   you will be taken to the form view of the aggregated vulnerability record.

   Important:

   • Zero Day Status Toggle: You can toggle the Zero Day status directly from the status pill in the header of the vulnerability record form. TISC supports zero-day vulnerabilities which are newly discovered security flaws without an assigned CVE identifier or remediation. These records may include an internal organizational identifier. As a zero-day vulnerability evolves, it can transition to a known CVE once an official identifier is assigned and remediation guidance is published.

     These records can include an internal organizational identifier. Over time, a zero-day vulnerability can transition to a known CVE after official identifier is assigned and remediation guidance is published.

     • By default, fields such as CVE ID and CVE Published Date remain empty.
     • An internal organizational identifier can be added in the Identifiers related records.
     • To enable or disable zero-day status, use the Zero-Day toggle button on the vulnerability record page, which marks or unmarks the vulnerability as a zero-day.
     • For manually created vulnerability source records, a dedicated Zero Day field is also available on the source record form.
       • Remediations Count: The form includes a Remediations Count field, which indicates the total number of remediations linked to the vulnerability. To view or manage these remediations, go to the Related Records tab and select the Remediations section.
       • Prevent System Updates: The form includes a Prevent System Updates check box. By selecting this option, you ensure that any updates made by analysts are retained, while system-generated updates are prevented. |Field|Description| |-----|-----------| |TISC Tags| |Select Tags|Select the tags that are associated with the vulnerability.| |Add Tags|Add new tags.| |Taxonomies| |Select Taxonomy|Select a Taxonomy that is associated with this vulnerability.| |Add Taxonomy Values|Add Taxonomy values that are associated with this vulnerability.|

   Note: TISC Tags & Taxonomies appears after you save the vulnerability record. You can add tags and taxonomies for an existing record.

   Add TISC tags to a Vulnerability record from the list view:

   • Select Add TISC Tags to associate the tags to the vulnerability record from the list view.
   • Search and select the desired tag.

   • Select Submit to add the tag.

     A confirmation displays indicating that the tags are applied successfully.

   Add Vulnerability record to a case from the list view:

   • Select Add to Case to add the vulnerability record to a case.
   • Select the case(s).

   • Select Add to add the case to the vulnerability record.

     The record is added to case(s) successfully.

3. If you want to delete any record then, select Delete to delete the aggregated record.

   When you select this action, then it will remove all the related records, except the original source data, and trigger re aggregation.

   Note:

   A confirmation message appears to verify that you want to delete the aggregated record. To also delete the associated source records and prevent re-aggregation, select the Delete Source Records check box. This action permanently removes all the related source records.

What to do next

Use the Related Records section to view the detailed information about objects associated with the vulnerability. Select any of related list to explore the linked records.

Related Records Actions

Each related list supports specific actions based on how the records are associated with the vulnerability record.

• Use Add and Remove when records are created from or deleted within the related list.

• Use Link and Unlink when associating or disassociating existing records without creating new ones. For more information, see Link Threat Intel Related Records.

  The available actions vary depending on the relationship type.

• The various SDOs in the Threat Intel Library contain potential relationships with other objects. To review and confirm these relationships, use the Potential Relationships link in the Threat Intel Library. For more information, see Confirm object-object potential relationships.

• You can also confirm relationships from the object’s form view by using the Related Records section and selecting the available entries under Potential Relationships. For more information on see, Confirm Potential Relationships from Related Records.
• You can add objects to cases. For more information, see Add to Case.

Parent Topic:Vulnerability Artifacts

Related topics

Access the Vulnerability Entities

Create a CWE record

Create a Product

Create a Vendor to a Vulnerability

Create Remediations