VulnLookup

Vulnerability Lookup

The Vulnerability Lookup module queries the CIRCL Vulnerability API to enrich CVE (Common Vulnerabilities and Exposures) identifiers with actionable intelligence, scoring metrics, and threat context.

Configuration & Limits

This module can operate in two modes based on your configuration:

1. Unauthenticated: If no API key is provided, the module operates normally but is subject to stricter rate limits.
2. Authenticated: Providing a CIRCL API key in your API Credentials grants access to significantly higher rate limits.

In either case, you can tune the request delays and retry logic within your Network Configuration to optimize performance and handle rate-limit responses.

Capabilities

The module accepts CVE nodes and extracts the following intelligence:

• Descriptions: Extracts the primary English summary and description of the vulnerability.
• CWE Classification: Extracts the underlying CWE (Common Weakness Enumeration) ID, along with a human-readable description of the weakness class.
• CPE Applicability: Extracts the CPE (Common Platform Enumeration) strings representing the vulnerable software or hardware configurations.
• CVSS Scoring: Extracts the best available Common Vulnerability Scoring System (CVSS) data, presenting the base score, severity, and vector string.
• EPSS Exploitation Probability: Extracts the Exploit Prediction Scoring System (EPSS) percentage and its percentile rank (RankEPSS), indicating the real-world likelihood of exploitation.
• Known Exploited Vulnerabilities (KEV): Checks if the CVE is present in the CISA KEV catalog and extracts the date it was added.
• SSVC Metrics: Extracts Stakeholder-Specific Vulnerability Categorization details, such as whether the vulnerability is "Automatable" or its current "Exploitation" status.