Swimlane Intelligence Native Action

9 min

Overview

The Swimlane Intelligence native action queries the Swimlane Intelligence service, a repository of cybersecurity information. The service currently provides CVE metadata and exploit information, with more data sources planned for the future. The action retrieves and returns detailed information about the specified CVE or vulnerability identifier, facilitating efficient vulnerability analysis.

Key Features:

CVE Search: Supports searching for a single CVE using its unique ID (e.g., CVE-2023-12345).

Multiple Data Categories: Query different types of vulnerability intelligence data.

Detailed Output: Returns comprehensive information about vulnerabilities, including severity scores, descriptions, exploit information, and related metadata.

Simple Configuration: Easy-to-use inputs for quick vulnerability lookups.

Requirements:

The Security Intelligence feature must be enabled for your account.

This action is not available in air-gapped environments.

How to Use

Open your playbook in the Turbine Canvas.

From the Add Panel, drag and drop the Swimlane Intelligence action into your Canvas.

Click on the action block to configure it.

Provide a unique Title and Key for the action:

Title: The display name for the action (for example, Get-CVE-Data).

Key: A system-generated unique identifier for the action (editable but must follow the naming convention: alphanumeric and underscores only).

Configure Inputs:

Click Configure to open the configuration panel.

Select Data Category (required):

Use the Select Data Category dropdown to choose the type of data to query. Available options include:

Vulnerability Exploits (dataset: exploits): Provides exploit-related information about the CVE, including:

Public, commercial, and weaponized exploit availability

Exploit maturity levels

Reported exploitation by threat actors, ransomware, or botnets

KEV (Known Exploited Vulnerabilities) status

EPSS (Exploit Prediction Scoring System) scores

Exploit timeline and trending information

Vulnerability Metadata (dataset: vulncheck-nvd2): Retrieves comprehensive metadata and analysis from the National Vulnerability Database (NVD), including:

CVSS (Common Vulnerability Scoring System) scores and severity ratings

Vulnerability descriptions and impact details

Affected systems and configurations (CPE)

CISA (Cybersecurity and Infrastructure Security Agency) information

MITRE ATT&CK techniques

References and links to additional information

Inputs Section:

ID (required):

Type: String

Description: Enter a single CVE ID (for example, CVE-2023-12345) to retrieve details about the vulnerability. This is the unique identifier for the document to retrieve from the selected dataset.

Input Methods:

Manual entry

Playbook property selection

Expression using dot notation (e.g., $event.data.cveId)

Apply Configuration:

Click Apply to save your settings and activate the action within the workflow.

Run the Query:

Execute the action to retrieve detailed information about the specified CVE or vulnerability identifier.

Inputs

The action requires two inputs:

dataset (required): The name of the data set to query. Available values:

exploits - Vulnerability Exploits dataset

vulncheck-nvd2 - Vulnerability Metadata dataset

id (required): The unique identifier for the CVE or vulnerability document to retrieve. This supports only a single ID at a time. For CVEs, use the standard format (e.g., CVE-2023-12345).

Outputs

The action returns detailed information about the queried vulnerability. The output structure varies based on the selected dataset:

Vulnerability Exploits Dataset Output

When using the exploits dataset, the output includes:

Exploit Availability:

public_exploit_found - Boolean indicating if public exploits exist

commercial_exploit_found - Boolean indicating if commercial exploits exist

weaponized_exploit_found - Boolean indicating if weaponized exploits exist

max_exploit_maturity - Maximum exploit maturity level

reported_exploited - Boolean indicating if exploitation has been reported

reported_exploited_by_threat_actors - Boolean indicating threat actor exploitation

reported_exploited_by_ransomware - Boolean indicating ransomware exploitation

reported_exploited_by_botnets - Boolean indicating botnet exploitation

KEV Status:

inKEV - Boolean indicating if CVE is in CISA KEV catalog

inVCKEV - Boolean indicating if CVE is in VulnCheck KEV catalog

Scoring and Metrics:

epss - EPSS (Exploit Prediction Scoring System) data including score and percentile

timeline - Exploit timeline information

trending - Trending information

counts - Various exploit count metrics

Vulnerability Metadata Dataset Output

When using the vulncheck-nvd2 dataset, the output includes:

CVE Information:

id - CVE identifier

descriptions - Vulnerability descriptions in multiple languages

STATUS - CVE status

ALIAS - CVE aliases

CVSS Scores:

metrics - CVSS metrics including:

cvssMetricV2 - CVSS v2.0 scores and vectors

cvssmetricv31 - CVSS v3.1 scores and vectors

temporalcvssv2 - Temporal CVSS v2.0 scores

temporalcvssv31 - Temporal CVSS v3.1 scores

baseScore, baseSeverity - Base severity scores

exploitabilityScore, impactScore - Component scores

CISA Information:

cisaActionDue - CISA action due date

cisaExploitAdd - CISA exploit addition date

cisaRequiredAction - Required action from CISA

cisaVulnerabilityName - CISA vulnerability name

Configuration and Impact:

configurations - Affected system configurations

cpeMatch - Common Platform Enumeration matches

nodes - Configuration nodes

Additional Metadata:

mitreAttackTechniques - Associated MITRE ATT&CK techniques

tags - Vulnerability tags

categorization - Vulnerability categorization

references - External references and links

Accessing Output Data

You can access the output data in subsequent actions using expressions:

$actions.actionName.result.result - Access the root result object

$actions.actionName.result.result.propertyName - Access specific properties

$actions.actionName.result.result.metrics.cvssMetricV31.baseScore - Access nested properties

Note: If the CVE or vulnerability identifier is not found in the dataset, the action will complete successfully but return an empty or null result.

Example Use Cases

Example 1: Query Vulnerability Exploits

Scenario: Check if a CVE has known exploits and assess exploit maturity.

Add the Swimlane Intelligence action to your playbook.

Select Vulnerability Exploits as the data category.

Enter the CVE ID (e.g., CVE-2023-12345) or use an expression like $event.data.cveId.

Access exploit information in subsequent actions:

$actions.getExploitInfo.result.result.public_exploit_found - Check if public exploits exist

$actions.getExploitInfo.result.result.max_exploit_maturity - Get exploit maturity level

$actions.getExploitInfo.result.result.epss.epss_score - Access EPSS score

Example 2: Query Vulnerability Metadata

Scenario: Retrieve comprehensive CVE metadata including CVSS scores and CISA information.

Add the Swimlane Intelligence action to your playbook.

Select Vulnerability Metadata as the data category.

Enter the CVE ID (e.g., CVE-2023-12345).

Access metadata in subsequent actions:

$actions.getCVEMetadata.result.result.metrics.cvssmetricv31.baseScore - Get CVSS v3.1 base score

$actions.getCVEMetadata.result.result.metrics.cvssmetricv31.baseSeverity - Get severity rating

$actions.getCVEMetadata.result.result.cisaRequiredAction - Get CISA required action

Example 3: Conditional Logic Based on Exploit Availability

Scenario: Use conditional logic to prioritize vulnerabilities with known exploits.

Query the Vulnerability Exploits dataset for a CVE.

Use a Condition action to check if public_exploit_found is true.

If true, trigger high-priority remediation actions.

If false, proceed with standard vulnerability management workflow.

Troubleshooting

Action Fails with Feature Not Enabled: Ensure the Security Intelligence feature is enabled for your account. Contact support if you believe this is an error.

Action Not Available: This action is not available in air-gapped environments. Use alternative methods to query vulnerability data in air-gapped deployments.

Empty Result Returned: If the action completes successfully but returns an empty result, the CVE or vulnerability identifier may not exist in the selected dataset. Verify:

The CVE ID format is correct (e.g., CVE-2023-12345)

The CVE exists in the selected dataset

The dataset name is spelled correctly

Dataset Not Found: Ensure you have selected a valid data category. Available datasets are:

exploits for Vulnerability Exploits

vulncheck-nvd2 for Vulnerability Metadata

Invalid CVE ID Format: Ensure the CVE ID follows the standard format: CVE-YYYY-NNNNN where YYYY is the year and NNNNN is the identifier number.

Best Practices

Choose the Right Dataset: Select the dataset that provides the information you need:

Use Vulnerability Exploits when you need exploit availability and maturity information

Use Vulnerability Metadata when you need comprehensive CVE details, CVSS scores, and CISA information

Handle Missing Results: Always check if the result is empty or null before accessing nested properties to avoid errors in your playbook.

Use Expressions for Dynamic CVE IDs: Instead of hardcoding CVE IDs, use expressions to reference CVE IDs from upstream actions, events, or variables (e.g., $event.data.cveId, $variables.cveId).

Cache Results When Possible: If querying the same CVE multiple times, consider storing the result in a variable to avoid redundant API calls.

Combine Datasets: For comprehensive vulnerability analysis, consider querying both datasets for the same CVE to get both exploit intelligence and detailed metadata.