CISA KEV Integration - Githubissues

nicpenning / Power-Nessie

Ingest Nessus files into Elasticsearch using PowerShell!

MIT License

3 stars 0 forks source link

CISA KEV Integration #1

Closed nicpenning closed 1 month ago

nicpenning commented 2 months ago

There is a new CISA integration for Elastic today that could be used in conjunction with this project: https://github.com/elastic/integrations/pull/9240.

This feature request will see how it can be merged into this project via a dashboard of sorts using ES|QL.

Tasks

[ ] Add Enrich Policy (After checking that CISA Integration is installed)
[ ] Optionally Ask to Install CISA Intergration in Fleet
[ ] Add Dashboard for CISA KEV / Nessus Correlations
[ ] Create Detection Rule for CVE detected that matches CISA KEV

nicpenning commented 1 month ago

As a simple fix for now, I added cisa_kev date field found in the Nessus data.

Via 1.2.0 release.

https://github.com/nicpenning/Power-Nessie/commit/7e131aa3e46dfaaf10c84ebd21bd00a4f43af939

Closing for the simple fix for now.