CVE Vulnerabilities

Overview

This method enables you to list all vulnerabilities found across the infrastructure in your Distributed Cloud AIP organization.

NOTE

The response defaults to display the active and suppressed vulnerabilities. This endpoint is paginated and returns up to 100 records at a time.

Sample Queries

Find all CVEs:

https://api.threatstack.com/v2/vulnerabilities

Find all active CVEs:

https://api.threatstack.com/v2/vulnerabilities?status=active

Find all active CVEs for which hasSecurityNotices is available:

https://api.threatstack.com/v2/vulnerabilities?status=active&hasSecurityNotices=true

Find all CVEs for a specific agentId:

https://api.threatstack.com/v2/vulnerabilities?agentId=<foo>

Overview

This method enables you to list all vulnerabilities found across the infrastructure in your Distributed Cloud AIP organization.

NOTE

You can only pass one CVE number at a time.

Sample Queries

Find all of the servers affected by a CVE:

https://api.threatstack.com/v2/vulnerabilities/{CVE}/servers

Error Handling Tips

The 404 error code means that the CVE was not found in the database.

Overview

This method enables you to get the list of CVEs found across the infrastructure in your Distributed Cloud AIP organization for a specific software package.

NOTE

You can only pass one package (without a version) at a time.

The response defaults to show both active and suppressed vulnerabilities.

Sample Queries

Find all CVEs for a package, example sudo:

https://api.threatstack.com/v2/vulnerabilities/package/sudo

To get the list of active CVEs for a package:

https://api.threatstack.com/v2/vulnerabilities/package/{package}?status=active

Error Handling Tips

The 400 error code means a required parameter is missing or is not correctly specified as a valid option for a parameter.

Overview

This method enables you to get the list of current CVE suppressions with suppression reason details for your organization.

Sample Queries

Find the list of current CVE suppressions with details:

https://api.threatstack.com/v2/vulnerabilities/suppressions

Error Handling Tips

The 400 error code means a required parameter is missing or is incorrectly specified and not a valid option for the parameter. You may hit this on an active query.

Overview

This method enables you to list all of the suppressed CVEs for a specific package.

NOTE

The list does not show the version of the suppressed CVEs.

Overview

This method enables you to list all of the suppressed CVEs in your Distributed Cloud AIP organization. The list returns all suppressed CVEs.

If you suppress a vulnerability, then the vulnerability for that package version is no longer assessed during a Vulnerability Assessment scan. It will display on a suppressed vulnerabilities list, and will not be listed as an active vulnerability. For more information, see the Vulnerability Assessment Overview

Available Queries

Filter for a Specific server

To view CVES for a particular server, you can use one of the following query params:

• agentID - The ID of the Agent
• hostname - The name of the host

You may only use one of these options per query. If multiple are used, the API returns a Bad Request.

Filter for a Specific Suppressed Vulnerability Severity

To view suppressed CVEs of a specific severity, use the severity query parameter. You can filter for high, medium, or low severities within Distributed Cloud AIP. For example, to view all low severity, suppressed CVEs:

https://api.threatstack.com/v2/vulnerabilities/suppressed?severity=low