Vulnerability Knowledge Base (VULN KB): Overview

Summary: High-level overview of the Vulnerability Knowledge Base (VULN KB).

The Vulnerability Knowledge Base (VULN KB) is an add-on feature that provides detailed information and analysis on vulnerability intelligence. It is both comprehensive and actionable, presenting knowledge and insight about the latest security vulnerabilities (CVEs) and their associated weaknesses (CWEs). VULN KB brings a comprehensive and exhaustive list of vulnerabilities (CVE) in a single easy-to-consume interface ideal for security analysts and threat hunter personas.

VULN KB includes the following:

The new VULN KB is accessible via a newly added menu option in the navigation bar labeled VULNERABILITY KB. The menu consists of the following three drop-down options.

Within each of these new knowledge base views, an updated filtering system has been implemented, allowing you to more easily identify the weaknesses and vulnerabilities your organization should focus on.

The Vulnerability KB Dashboard provides insightful visualization on vulnerabilities, their threat context, and a comparison of their severity level as compared with RiskSense VRR. Dashboard widgets display top trending vulnerabilities and top vulnerabilities based on vendors. Vulnerability distributions based on software weaknesses (CWE) are also shown, with a focus on OWASP Top 10 and CWE Top 25. The dashboard can be filtered based on Vendors and CVE published year to view a more granular distribution of vulnerabilities.

VULN KB features two list views: Vulnerabilities and Weaknesses. The Vulnerabilities list view provides detailed information on all known vulnerabilities in the RiskSense database, regardless of context. This database is updated daily. The list view includes KRI cards, a complete list of CVE vulnerabilities, and a detailed pane. It is filterable using Quick Filters or a more detailed filtering system. The Weaknesses list view focuses on the full list of available software weaknesses (CWEs) as defined by MITRE and features the same filtering capabilities as the Vulnerabilities view.

To quickly and easily identify the data your organization is interested in, two kinds of filtering functionality have been made available. Quick filtering is provided on the left side of the screen and allows easy application of commonly-used filters. At the top of the list view, a detail filtering option is provided that includes functionality to collect various filter categories by AND logic as well as OR logic. The OR capability can be used to enhance the types of filters and results that you are looking for. Up to three OR groups can be used in filtering to get more granular results with complex searches.

Clicking on a particular vulnerability’s identifier will open a detail page for that vulnerability. This page provides CVSS and VRR scores, an overview of the vulnerability, exploits, and malware associated with the vulnerability. It also provides information on affected products, including details such as vendors, affected product versions, and fixes and solution information.