Spotlight Vulnerability Metadata

The Spotlight Vulnerability Metadata service collection provides operations for retrieving Risk (vulnerability metadata) entities. Perform combined queries to retrieve CVE metadata including CVSS scores, temporal metrics, and risk provider information using FQL filters.

Language	Last Update
Python	v1.5.5
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Table of Contents

Operation	Description
combineVulnMetadataExt get_cve_metadata	Perform a combined query and get operation for retrieving Risk (vulnerability metadata) entities.

---

combineVulnMetadataExt

Perform a combined query and get operation for retrieving Risk (vulnerability metadata) entities.

GET /spotlight/combined/vulnerability-metadata-external/v1

Scope Risk Platform Risk: READ Consumes · Produces application/json

PEP 8 get_cve_metadata

Parameters

Name	Type	Data type	Description
after	query	string	A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.
filter	query	string	Filter items using a query in Falcon Query Language (FQL). Wildcards * and empty filter values are unsupported. Available filter fields that support exact match: id, provider, cve_ids, cwe_ids, impact.cvss_v2.base_metrics.vector, impact.cvss_v2.temporal_metrics.vector, impact.cvss_v3.base_metrics.integrity_impact, impact.cvss_v3.base_metrics.vector, impact.cvss_v3.temporal_metrics.vector. Available filter fields that support range comparisons (>, <, >=, <=): created_timestamp, impact.cvss_v2.base_metrics.base_score, impact.cvss_v3.base_metrics.base_score, impact.cvss_v2.temporal_metrics.temporal_score, impact.cvss_v3.temporal_metrics.temporal_score, source_created_timestamp, source_updated_timestamp, updated_timestamp. Required.
limit	query	integer	The number of items to return in this response (default: 100, max: 400). Use with the after parameter to manage pagination of results.
offset	query	string	Starting index of overall result set from which to return ids.
risk_provider	query	string or list of strings	Zero or more risk providers. Zero means all. Supported values: S (for Falcon sensor).
sort	query	string	Sort vulnerabilities by their properties. Available sort options: created_timestamp|asc/desc, updated_timestamp|asc/desc.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

Python

PEP 8

from falconpy import SpotlightVulnerabilityMetadata

falcon = SpotlightVulnerabilityMetadata(client_id=CLIENT_ID,
                                        client_secret=CLIENT_SECRET
                                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_cve_metadata(after="string",
                                   offset="string",
                                   limit=integer,
                                   sort="string",
                                   filter="string",
                                   risk_provider=id_list)
print(response)

Operation ID

from falconpy import SpotlightVulnerabilityMetadata

falcon = SpotlightVulnerabilityMetadata(client_id=CLIENT_ID,
                                        client_secret=CLIENT_SECRET
                                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.combineVulnMetadataExt(after="string",
                                         offset="string",
                                         limit=integer,
                                         sort="string",
                                         filter="string",
                                         risk_provider=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("combineVulnMetadataExt",
                          after="string",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          risk_provider=id_list)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/spotlight_vulnerability_metadata"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.SpotlightVulnerabilityMetadata.CombineVulnMetadataExt(
    &spotlight_vulnerability_metadata.CombineVulnMetadataExtParams{
      After: &after,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: "string",
      RiskProvider: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.spotlightVulnerabilityMetadata.combineVulnMetadataExt(
  "string",  // filter
  "string",  // after
  "string",  // offset
  integer,  // limit
  "string",  // sort
  ["ID1", "ID2", "ID3"]  // riskProvider
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SpotlightVulnerabilityMetadata.new

response = api.combine_vuln_metadata_ext('string')

puts response