Spotlight Vulnerability Metadata

The Spotlight Vulnerability Metadata service collection provides operations for retrieving Risk (vulnerability metadata) entities. Perform combined queries to retrieve CVE metadata including CVSS scores, temporal metrics, and risk provider information using FQL filters.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust
Ruby	v1.4.0

Operation	Description
combineVulnMetadataExt `get_cve_metadata`	Performs a combined query and get operation for retrieving Risk (vulnerability metadata) entities.

combineVulnMetadataExt

Performs a combined query and get operation for retrieving Risk (vulnerability metadata) entities.

Method GET

Route /spotlight/combined/vulnerability-metadata-external/v1

Scope Risk Platform - Risk: READ

PEP 8 get_cve_metadata

Parameters

after query · string

A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an after token. On subsequent requests, provide the after token from the previous response to continue from that place in the results.

offset query · string

Starting index of overall result set from which to return ids.

limit query · integer

The number of items to return in this response (default: 100, max: 400). Use with the after parameter to manage pagination of results.

sort query · string

Sort vulnerabilities by their properties. Available sort options: created_timestamp|asc/desc, updated_timestamp|asc/desc.

filter query · string

Filter items using a query in Falcon Query Language (FQL). Wildcards * and empty filter values are unsupported. Available filter fields:

Available values (14)

`provider`	`cve_ids`	`cwe_ids`
`impact.cvss_v2.base_metrics.vector`	`impact.cvss_v2.temporal_metrics.vector`	`impact.cvss_v3.base_metrics.integrity_impact`
`impact.cvss_v3.base_metrics.vector`	`impact.cvss_v2.base_metrics.base_score`	`impact.cvss_v3.base_metrics.base_score`
`impact.cvss_v2.temporal_metrics.temporal_score`	`impact.cvss_v3.temporal_metrics.temporal_score`	`source_created_timestamp`
`source_updated_timestamp`	`updated_timestamp`

risk_provider query · string or list of strings

zero or more risk providers - zero means all. Supported values:

Available values (2)

S See

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import SpotlightVulnerabilityMetadata

falcon = SpotlightVulnerabilityMetadata(client_id=CLIENT_ID,
                                        client_secret=CLIENT_SECRET
                                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_cve_metadata(after="string",
                                   offset="string",
                                   limit=integer,
                                   sort="string",
                                   filter="string",
                                   risk_provider=id_list)
print(response)

from falconpy import SpotlightVulnerabilityMetadata

falcon = SpotlightVulnerabilityMetadata(client_id=CLIENT_ID,
                                        client_secret=CLIENT_SECRET
                                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.combineVulnMetadataExt(after="string",
                                         offset="string",
                                         limit=integer,
                                         sort="string",
                                         filter="string",
                                         risk_provider=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("combineVulnMetadataExt",
                          after="string",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          risk_provider=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/spotlight_vulnerability_metadata"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  after := "string"
  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.SpotlightVulnerabilityMetadata.CombineVulnMetadataExt(
    &spotlight_vulnerability_metadata.CombineVulnMetadataExtParams{
      After: &after,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: "string",
      RiskProvider: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.spotlightVulnerabilityMetadata.combineVulnMetadataExt(
  "string",  // filter
  "string",  // after
  "string",  // offset
  integer,  // limit
  "string",  // sort
  ["ID1", "ID2", "ID3"]  // riskProvider
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::SpotlightVulnerabilityMetadata.new

response = api.combine_vuln_metadata_ext('string')

puts response

Responses

[
  {
    "alias": "string",
    "cid": "string",
    "created_timestamp": "string",
    "cve_ids": [],
    "cwe_ids": [],
    "description": "string",
    "id": "string",
    "impact": {},
    "is_evaluation_supported": false,
    "name": "string",
    "provider": "string",
    "provider_metadata": {},
    "references": [],
    "risk_metadata": {},
    "source_created_timestamp": "string",
    "source_updated_timestamp": "string",
    "supported_finding_providers": [],
    "supported_finding_providers_full_name": [],
    "updated_timestamp": "string",
    "version": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {
      "alias": "string",
      "cid": "string",
      "created_timestamp": "string",
      "cve_ids": [],
      "cwe_ids": [],
      "description": "string",
      "id": "string",
      "impact": {},
      "is_evaluation_supported": false,
      "name": "string",
      "provider": "string",
      "provider_metadata": {},
      "references": [],
      "risk_metadata": {},
      "source_created_timestamp": "string",
      "source_updated_timestamp": "string",
      "supported_finding_providers": [],
      "supported_finding_providers_full_name": [],
      "updated_timestamp": "string",
      "version": "string"
    }
  ]
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "after": "string",
      "limit": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string"
  },
  "resources": [
    {
      "alias": "string",
      "cid": "string",
      "created_timestamp": "string",
      "cve_ids": [],
      "cwe_ids": [],
      "description": "string",
      "id": "string",
      "impact": {},
      "is_evaluation_supported": false,
      "name": "string",
      "provider": "string",
      "provider_metadata": {},
      "references": [],
      "risk_metadata": {},
      "source_created_timestamp": "string",
      "source_updated_timestamp": "string",
      "supported_finding_providers": [],
      "supported_finding_providers_full_name": [],
      "updated_timestamp": "string",
      "version": "string"
    }
  ]
}

Spotlight Vulnerability Metadata

Table of Contents

combineVulnMetadataExt

Parameters