Swimlane VRM Enrichment

swimlane vrm enrichment automates the enrichment, correlation, and export of vulnerability findings to optimize vulnerability risk management workflows swimlane vrm enrichment extends swimlane turbine with advanced vulnerability risk management capabilities this connector enables automated enrichment, grouping, and prioritization of vulnerability findings by leveraging intelligence caches, custom risk scoring, and bulk data processing users can seamlessly export, stage, and enrich vulnerability data from multiple sources, accelerating triage and remediation workflows integration with swimlane vrm enrichment empowers security teams to automate vulnerability lifecycle management, reduce manual effort, and improve risk based decision making within their low code security automation environment prerequisites to use the swimlane vrm enrichment connector, ensure you have the following prerequisites configured swimlane tenant and vrm application configuration for enrichment connector actions, requiring page size number of records to process per page during ingestion or export account id unique identifier for the swimlane account used for api access tenant id identifier for your swimlane tenant environment host the base url or hostname of your swimlane instance private access token secure token for authenticating api requests to swimlane assets application name name of the swimlane application managing asset records exceptions application name name of the application handling exception records findings application name name of the application where vulnerability findings are stored ingestion pages application name name of the application tracking ingestion pages staged ingestion application name name of the application for staged ingestion records export findings & assets application name name of the application used for exporting findings and assets export findings & assets record id identifier for the specific record to be exported grouping parameters criteria used to group findings or assets during processing or export capabilities this connector provides the following capabilities capabilities go here e g manage firewall policies instead of listing each individual tasks limitations include information about known limitations here, including supported or minimum versions, especially known unsupported versions asset setup the content here should discuss asset setup in a conversational manner be sure to include any known login and test connection errors tasks setup special task setup as needed depending on plugin, exclude if empty known available allowed input options from enum type selection notes any other notes not fitting other sections go here any reference urls to external docs or other resources configurations vrm client configuration swimlane tenant and vrm application configuration for enrichment connector actions configuration parameters parameter description type required page size the number of incoming findings to store in a staging record integer required account id the swimlane account id string required tenant id the swimlane tenant id string required host the swimlane host (e g , stage swimlane app) string required pat the private access token for api authentication string required assets app the name of the assets application string required exceptions app the name of the exceptions application string required findings app the name of the findings application string required ingestion pages app the name of the ingestion pages application string required staged ingestion app the name of the staged ingestion application string required export findings app the name of the vrm export findings & assets application string required export findings assets record id tracking id of the export record holding export findings and export assets csv attachments (e g vef 1) string required swimlane intelligence bulk batch size number of cve ids per intelligence bulk api request in populate swimlane intelligence cache lower values (e g 100–200) reduce memory use on 512 mb connector pods integer optional risk score parameters json string containing risk score parameter definitions (weights, max values, keys, etc ) string optional grouping parameters required json string with ordered grouping rules (type numeric string string array boolean presence, literal right operand values) rules are maintained offline and must be set on the vrm client configuration asset string required actions enrich findings enhance findings by leveraging the swimlane intelligence cache, exported vrm findings and assets csvs, and incoming findings on the vrm staged ingestion record endpoint method post input argument name type required description staging record id string required the tracking id or record id of the staging record to process (e g vsi 5) concurrency integer optional maximum number of concurrent api calls (default 10) batch size integer optional number of records per bulk create api call (default 50) only applies when batching is enabled uses post /v2/record/bulk use batching boolean optional use the v2 bulk record ingest api for creating new findings (much faster) set to false to use individual creates failed records are retried via failedrecordids turbine risk score floor value number optional new findings are created only when vulnerability finding turbine risk score is strictly greater than this value existing findings are still updated regardless default is 0 input example {"staging record id" "string","concurrency" 10,"batch size" 50,"use batching"\ true,"turbine risk score floor value" 123} output parameter type description status string outcome of the enrichment process ( success or error ) error string error message when status is error findings processed number number of findings processed findings successful number total findings successfully written (created + updated) findings created number number of new findings created in swimlane findings updated number number of existing findings updated in swimlane findings skipped number number of findings skipped findings ignored number number of new findings not created because vulnerability finding turbine risk score was at or below turbine risk score floor value findings failed number number of findings that failed failed findings file array json file containing findings that failed enrichment failed findings file file string the file id failed findings file file name string the filename output example {"status" "string","error" "string","findings processed" 123,"findings successful" 123,"findings created" 123,"findings updated" 123,"findings skipped" 123,"findings ignored" 123,"findings failed" 123,"failed findings file" \[]} export all records export all records from a specified swimlane application to a csv or gzip compressed csv file, replicating the native export record functionality for use in connector playbooks endpoint method post input argument name type required description application name string required name of the swimlane application to export records from filtered fields array optional field keys to include as csv columns when empty, all application fields are exported is compressed boolean optional when true (default), output is a gzip compressed csv ( csv gz) when false, output is a plain csv file input example {"application name" "example name","filtered fields" \["string"],"is compressed"\ true} output parameter type description status string outcome of the export ( success or error ) error string error message when status is error application name string resolved application name application id string application id that was exported record count number number of records exported is compressed boolean whether the export file is gzip compressed export file array exported csv or gzip compressed csv attachment for downstream playbook use export file file string turbine file urn (or base64 when running locally without ipc) export file file name string export filename ( csv or csv gz) export filename string filename of the exported attachment export size bytes number size of the exported file in bytes field count number number of columns exported progress log array action progress messages output example {"status" "string","error" "string","application name" "string","application id" "string","record count" 123,"is compressed"\ true,"export file" \[],"export filename" "string","export size bytes" 123,"field count" 123,"progress log" \[]} populate swimlane intelligence cache populate the vulnerability intelligence cache using bulk cve lookups from a staging record and return compressed cache files for playbook upsert endpoint method post input argument name type required description staging record id string required the tracking id or record id of the staging record to process input example {"staging record id" "string"} output parameter type description status string outcome of the cache population process ( success or error ) error string error message when status is error swimlane intelligence cache file array compressed swimlane intelligence cache file(s) for playbook upsert (may be split into multiple parts if >512mb) swimlane intelligence cache file file string turbine file urn for upsert attachment field swimlane intelligence cache file file name string the filename (e g swimlane intelligence cache db gz) staging record id string tracking id of the staging record that was processed total findings count number total number of findings that have cve ids findings failed metadata count number number of findings that failed metadata enrichment findings failed exploit count number number of findings that failed exploit enrichment populated count number number of cve ids successfully cached failed exploit ids array list of cve ids that failed exploit lookup failed metadata ids array list of cve ids that failed metadata lookup cache storage filename string filename of the compressed cache file output example {"status" "string","error" "string","swimlane intelligence cache file" \[],"staging record id" "string","total findings count" 123,"findings failed metadata count" 123,"findings failed exploit count" 123,"populated count" 123,"failed exploit ids" \[],"failed metadata ids" \[],"cache storage filename" "string"} stage enrichment read ingestion pages and create a staging record in swimlane vrm enrichment for further processing endpoint method get output parameter type description status string the status of the enrichment staging run staging record id string tracking id of the created vrm staged ingestion record (e g vsi 5) findings collected number number of findings collected from ingestion pages remaining findings number number of findings written back to the last ingestion page error string error message when the action fails output example {"status" "string","staging record id" "string","findings collected" 123,"remaining findings" 123,"error" "string"} response headers header description example content type the media type of the resource application/json date the date and time at which the message was originated thu, 01 jan 2024 00 00 00 gmt