CWEs (Common Weakness Enumeration)

OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform

https://opencti.io

Other

5.17k stars 819 forks source link

CWEs (Common Weakness Enumeration) #6557

Open iFrozenPhoenix opened 3 months ago

iFrozenPhoenix commented 3 months ago

Use case

Analyzing the cause of a vulnerability. This would allow to prioritize and eventually allow for mitigation in cases where there is no official fix for the vulnerability (0 day).

Current Workaround

Managing Vulnerabilities and their CWEs additionally in an external database outside OpenCTI.

Proposed Solution

New Entity Type Weakness (Analog to attack pattern). This vulnerability can then be related to the weakness with a has relationship.

Additional Information

If the feature request is approved, would you be willing to submit a PR?

Yes / No (Help can be provided if you need assistance submitting a PR)

nino-filigran commented 3 months ago

Hey @iFrozenPhoenix we've found a workaround for the moment (assuming you want to map the CWEs to the CVEs existing in NVD https://cwe.mitre.org/data/definitions/1003.html):

First, you can define a new Kill chain phase (in settings/Taxonomies/Kill chain phases), for each "parent" CWE (in the above example, Improper Input Validation - (20) would be a parent).
Then, for each parent, create a attack parent and link it to the parent kill chain phase (in our example, Improper Validation of Specified Quantity in Input - (1284) would be an attack pattern linked to the parent kill chain phase Improper Input Validation - (20)).
Then you can link a vulnerability with an attack pattern representing your CWE.

Would that work for you at the moment? If not could you maybe in more details what is not satisfactory in regards of your use case ?

iFrozenPhoenix commented 3 months ago

@nino-filigran yes this could work for the moment. Are there plans to add CWEs to the Platform?

nino-filigran commented 3 months ago

Not at the moment, unless we get more requests on this topics/if the workaround does not answer fully your use case. soon, we'll work on ensuring that organisation can understand their vulnerabilities (by being better at linking CVEs and CPEs, to provide a proper feature of vulnerability assesment). This is more the direction that we're looking at at the moment.

iFrozenPhoenix commented 3 months ago

@nino-filigran that sounds really interesting. Can you tell a bit more what you mean with vulnerability assessment? I know that you focus on linking cpes to cves and also strive for an asset management integration, tenable if I remember correct.