Hi,
InsightVM Plugin, o using the get asset option
Looking at the output, Im struggling to see what site an asset is in.
I have a CVE, I then use the plugin to get vulnerable assets, i use the asset id to then get the asset and depending on the site, depends who recieves the notification.
If Im honest, Im only want hostname,ip,site maybe OS returned. But seems hard work to get…
Any ideas on how to achieve? I thought about tags also but thats also not in the get asset option
@phil_pearce You are correct that site IDs are not something included with the output of assets unfortunately. This might be a place where we can enhance the plugin to get the information; however, right now it’s a bit dependent on the API response. I was trying to think of a way around it and was wondering if the following would work:
searchCriteria of Site ID and CVE. Search Criteria in the InsightConnect action would be an object like below:{
"match": "all",
"filters": [
{"field": "cve", "operator": "is", "value": "CVE-1234"},
{"field": "site-id", "operator": "in", "value": "1234"}
]
}