VulnCheck
Threat Intelligence- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The VulnCheck Connector integrates with the VulnCheck threat-intelligence platform and synchronizes vulnerability and exploit intelligence into Brinqa. It downloads VulnCheck's data export ("backup") indices over HTTPS and maps them to Brinqa UDM models, including:
- CVE records enriched with NVD data, EPSS scores, CISA KEV / VulnCheck KEV details, CISA Vulnrichment SSVC decision points, exploit/weaponization signals, Microsoft KB threat data, and MITRE ATT&CK technique references.
- CWE weaknesses from the MITRE CWE catalog.
- CPE records from the VulnCheck CPE dictionary and the NVD CPE-match index.
- EOL advisories describing end-of-life product releases.
- MITRE ATT&CK techniques correlated to CVEs.
- Vendor security advisories from more than twenty publishers (Adobe, Chrome, Cisco, Citrix, Dell, Fedora, GCP, GitHub, HP, IBM, Intel, Kubernetes, Linux, Microsoft, MongoDB, Mozilla, Netgear, Oracle, Palo Alto, PostgreSQL, Red Hat, SUSE, Ubuntu).
Each VulnCheck index is fetched as a ZIP archive, decompressed (some entries are further GZIP-compressed), parsed as JSON, and mapped to connector objects.
Data retrieved from VulnCheck
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| CVE | Yes | Cve Record |
| CWE | Yes | Weakness |
| CPE | Yes | Cpe Record |
| CPE Match | Yes | Cpe Record |
| EOL Advisory | Yes | Eol Advisory |
| MITRE ATT&CK CVE | Yes | Attack Technique |
| Adobe | Yes | Security Advisory |
| Chrome | Yes | Security Advisory |
| Cisco | Yes | Security Advisory |
| Citrix | Yes | Security Advisory |
| Dell | Yes | Security Advisory |
| Fedora | Yes | Security Advisory |
| Gcp | Yes | Security Advisory |
| Github | Yes | Security Advisory |
| Hp | Yes | Security Advisory |
| Ibm | Yes | Security Advisory |
| Intel | Yes | Security Advisory |
| Kubernetes | Yes | Security Advisory |
| Linux | Yes | Security Advisory |
| Microsoft CVRF | Yes | Security Advisory |
| Mongodb | Yes | Security Advisory |
| Mozilla | Yes | Security Advisory |
| Netgear | Yes | Security Advisory |
| Oracle | Yes | Security Advisory |
| PaloAlto | Yes | Security Advisory |
| PostgreSql | Yes | Security Advisory |
| Redhat | Yes | Security Advisory |
| Suse | Yes | Security Advisory |
| Ubuntu | Yes | Security Advisory |
Model relationships
For detailed steps on how to view the data retrieved from VulnCheck in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select VulnCheck from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Api URL | No | — | VulnCheck api url |
| Api token | No | — | VulnCheck api token |
| Preferred CVSS V3 source | No | — | Select which CVSS v3 authority should be used when multiple scores are available (NIST or CISA-ADP) |
Authentication
The connector authenticates to the VulnCheck API using a Bearer token (API token). The token is supplied as a configuration property and sent on every request in the Authorization header.
Endpoints
| Method | URL | Purpose |
|---|---|---|
| GET | {Api URL}/v3/index | Connection test (used by the connector's test operation). |
| GET | {Api URL}/v3/backup/{index} | Retrieve the download URL(s) for a data export index (e.g. vulncheck-nvd2, cwe, exploits, adobe). |
| GET | {download URL} | Download the ZIP export referenced by the backup index response. |
The default Api URL is https://api.vulncheck.com.
Request Headers
| Header | Value |
|---|---|
Authorization | Bearer {API token} |
User-Agent | Integration/1.0 (Brinqa; VulnCheck Connector; Build/{version}) |
X-Requested-With | brinqa (sent on export download requests) |
Sample Request
GET /v3/backup/vulncheck-nvd2 HTTP/1.1
Host: api.vulncheck.com
Authorization: Bearer <api-token>
Sample Response
The backup index response returns one or more time-stamped download URLs for the requested export:
{
"_benchmark": 0.123,
"_meta": { "timestamp": "2024-04-12T12:51:59Z" },
"data": [
{
"url": "https://storage.googleapis.com/vulncheck-backups/vulncheck-nvd2-2024-04-12.zip",
"date_added": "2024-04-12T00:00:00Z"
}
]
}
Response Fields
| Field | Description |
|---|---|
data | List of available export files for the index. |
data[].url | Signed URL of the ZIP export to download. |
data[].date_added | Timestamp the export file was produced. |
Using the Token
The API token is configured once and is automatically attached to every outgoing request as Authorization: Bearer {token}. The same token is used both for retrieving the backup index URLs and for downloading the referenced export archives.
Sync Behavior
Each sync is a full sync. Every run fetches the export index, downloads the referenced archive, and processes every record. A since (Instant) sync token is accepted by the sync operation, but the VulnCheck backup exports are full snapshots, so the connector re-processes the complete export each time rather than applying an incremental time filter. The latest sync token is not tracked (getLatestSyncToken returns null).
How to obtain VulnCheck credentials
Obtain the required credentials (Api URL, Api token) from your VulnCheck administrator or the VulnCheck admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
CVE
| Source Field Name | SDM Attribute |
|---|---|
| ALIAS | ALIAS |
categorization.tags | TAGS |
| cisa_date_added | CISA_KEV_DATE |
cisaActionDue | CISA_DUE_DATE |
cisaRequiredAction | CISA_REQUIRED_ACTION |
| commercial_exploit_found | COMMERCIAL_EXPLOIT |
| date_added | SOURCE_CREATED_DATE |
| derived from cisa_date_added | IN_CISA_KEV |
| derived from selected CVSS v2/v3/v4 vector strings | (CVSS base/temporal metrics) |
descriptions[lang=en].value | DESCRIPTION |
id | NAME |
id (vulncheck-nvd2) | UID |
inKEV | CISA_EXPLOITED |
inVCKEV | IN_VCKEV |
knownRansomwareCampaignUse (vulncheck-kev) | KNOWN_ACTIVE_RANSOMWARE_CAMPAIGN |
lastModified | SOURCE_LAST_MODIFIED |
| max_exploit_maturity | EXPLOIT_MATURITY |
metrics.cvssMetricV2[].source | CVSS_V2_BASE_VECTOR_SOURCE |
metrics.cvssMetricV31[].source | CVSS_V3_BASE_VECTOR_SOURCE |
metrics.cvssMetricV31[].source | CVSS_V3_TEMPORAL_VECTOR_SOURCE |
metrics.cvssMetricV40[].source | CVSS_V4_VECTOR_SOURCE |
metrics.epss.epss_percentile | EPSS_PERCENTILE |
metrics.epss.epss_score | EPSS_SCORE |
metrics.epss.last_modified | EPSS_LAST_MODIFIED |
metrics.temporalCvssV2Secondary[].source | CVSS_V2_TEMPORAL_VECTOR_SOURCE |
mitreAttackTechniques[].id | ATTACK_TECHNIQUES |
public_exploit_found (exploits) | PUBLIC_EXPLOIT |
published | PUBLISHED_DATE |
references[] | REFERENCES |
relatedAttackPatterns[].capec_id | ATTACK_PATTERNS |
| reported_exploited | REPORTED_EXPLOITED |
| reported_exploited_by_botnets | USED_BY_BOTNETS |
| reported_exploited_by_ransomware | USED_BY_RANSOMWARE |
| reported_exploited_by_threat_actors | USED_BY_THREAT_ACTORS |
| required_action | RECOMMENDATION |
shortDescription | SUMMARY |
sourceIdentifier | SOURCE_IDENTIFIER |
ssvc[source=CISA-ADP].automatable | CISA_AUTOMATABLE |
ssvc[source=CISA-ADP].exploitation | CISA_EXPLOITATION |
ssvc[source=CISA-ADP].technicalImpact | CISA_TECHNICAL_IMPACT |
sync time (connector-generated) | LAST_CAPTURED |
threat.dos | DOS |
threat.exploited | THREAT_EXPLOITED |
threat.latest_software_release | THREAT_LATEST_SOFTWARE_RELEASE |
threat.level | THREAT_LEVEL |
threat.older_software_release | THREAT_OLDER_SOFTWARE_RELEASE |
threat.publicly_disclosed | THREAT_PUBLICLY_DISCLOSED |
threat.type (microsoft-kb) | THREAT_TYPE |
timeline.first_exploit_published | FIRST_EXPLOIT_PUBLISHED |
timeline.first_exploit_published_weaponized_or_higher | FIRST_EXPLOIT_PUBLISHED_WEAPONIZED |
timeline.first_reported_botnet | FIRST_REPORTED_BOTNET |
timeline.first_reported_ransomware | FIRST_REPORTED_RANSOMWARE |
timeline.first_reported_threat_actor | FIRST_REPORTED_THREAT_ACTOR |
timeline.first_reported_vulncheck_canaries | FIRST_REPORTED_VULNCHECK_CANARIES |
timeline.most_recent_exploit_published | MOST_RECENT_EXPLOIT_PUBLISHED |
timeline.most_recent_reported_botnet | MOST_RECENT_REPORTED_BOTNET |
timeline.most_recent_reported_ransomware | MOST_RECENT_REPORTED_RANSOMWARE |
timeline.most_recent_reported_threat_actor | LAST_REPORTED_THREAT_ACTOR |
trending.github | GITHUB_TRENDING |
| vulncheckKEVExploitAdd / cisaExploitAdd | CISA_ADDED_DATE |
vulnerableCPEs | AFFECTED / CPE_RECORDS |
vulnStatus | SOURCE_STATUS |
weaknesses[].description[lang=en].value | CWE_IDS / WEAKNESSES |
| weaponized_exploit_found | WEAPONIZED_EXPLOIT |
CWE
| Source Field Name | SDM Attribute |
|---|---|
abstraction | ABSTRACTION |
| CWE- + weakness_id | UID |
description | DESCRIPTION |
| kev_count | KEV_COUNT |
status | STATUS |
structure | STRUCTURE |
sync time (connector-generated) | LAST_CAPTURED |
| vulncheck_nvd_count | VULN_CHECK_NVD_COUNT |
weakness_name (falls back to UID) | NAME |
| weighted_score | WEIGHTED_SCORE |
CPE
| Source Field Name | SDM Attribute |
|---|---|
| parsed from CPE | NAME |
| parsed from CPE | VERSION |
| parsed from CPE | PART |
| parsed from CPE | VENDOR |
| parsed from CPE | PRODUCT |
| parsed from CPE | EDITION |
| parsed from CPE | LANG |
| parsed from CPE | OTHER |
| parsed from CPE | SOFTWARE_EDITION |
| parsed from CPE | TARGET_HARDWARE |
| parsed from CPE | TARGET_SOFTWARE |
| parsed from CPE | UPDATE |
sync time (connector-generated) | LAST_CAPTURED |
versions[] | UID / BASE_CPE_NAME |
CPE Match
| Source Field Name | SDM Attribute |
|---|---|
created | SOURCE_CREATED_DATE |
criteria | UID |
| lastModified / cpeLastModified | SOURCE_LAST_MODIFIED |
matchCriteriaId | MATCH_CRITERIA_ID |
| parsed from criteria | NAME |
| parsed from criteria | PART |
| parsed from criteria | VENDOR |
| parsed from criteria | PRODUCT |
| parsed from criteria | VERSION |
| parsed from criteria | UPDATE |
| parsed from criteria | EDITION |
| parsed from criteria | LANG |
| parsed from criteria | SOFTWARE_EDITION |
| parsed from criteria | TARGET_SOFTWARE |
| parsed from criteria | TARGET_HARDWARE |
| parsed from criteria | OTHER |
status | STATUS |
sync time (connector-generated) | LAST_CAPTURED |
EOL Advisory
| Source Field Name | SDM Attribute |
|---|---|
| already_eol | IS_EOL |
cpe | CPE_RECORDS |
| eol_date | EOL_DATE |
| MD5 of source_url + cpe | UID |
product | PRODUCT |
| release_date | RELEASE_DATE |
| release_name | NAME |
| source_url | URL |
sync time (connector-generated) | LAST_CAPTURED |
vendor | VENDOR |
MITRE ATT&CK CVE
| Source Field Name | SDM Attribute |
|---|---|
| cve_list | CVE_RECORDS / CVE_IDS |
derived from technique_id.id | PARENT_TECHNIQUE |
sync time (connector-generated) | LAST_CAPTURED |
technique_id.domain | DOMAIN |
technique_id.id | UID |
technique_id.name | NAME |
technique_id.subtechnique | SUB_TECHNIQUE |
technique_id.tactics | TACTICS |
technique_id.url | URL |
Adobe
| Source Field Name | SDM Attribute |
|---|---|
| "Adobe " + UID | NAME |
Affected[].Product / .Version / .Platform | AFFECTED |
| BulletinId | UID |
| constant Adobe | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| Link | URL |
Solutions[] | RECOMMENDATION |
sync time (connector-generated) | LAST_CAPTURED |
Chrome
| Source Field Name | SDM Attribute |
|---|---|
| constant Google Chrome | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of Title + date_added | UID |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
| Url | URL |
Cisco
| Source Field Name | SDM Attribute |
|---|---|
ciscoBugId | CISCO_BUG_ID |
| constant Cisco | VENDOR |
csaf | CSAF |
cve | CVE_RECORDS / CVE_IDS |
cvrf | CVRF |
cwe | WEAKNESSES / CWE_IDS |
| date_added | PUBLISHED_DATE |
identifier | UID |
name | CISCO_NAME |
severity | SOURCE_SEVERITY |
status | SOURCE_STATUS |
summary | DESCRIPTION |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
version | CURRENT_VERSION |
workarounds | WORK_AROUNDS |
workflowStatus | WORK_FLOW_STATUS |
Citrix
| Source Field Name | SDM Attribute |
|---|---|
| CitrixId | UID |
| constant Citrix | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| Link | URL |
| Products | AFFECTED |
| Severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
Dell
| Source Field Name | SDM Attribute |
|---|---|
| CombinedProductList | AFFECTED |
| constant Dell | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| Severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
| Url | UID |
| Url | URL |
Fedora
| Source Field Name | SDM Attribute |
|---|---|
| constant Fedora | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
id | UID |
issued.Date | PUBLISHED_DATE |
| os_arch | OS_ARCH |
| os_version | OS_VERSION |
packages[] | AFFECTED |
references[] | REFERENCES |
severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
type | TYPE |
updated.Date | SOURCE_LAST_MODIFIED |
Gcp
| Source Field Name | SDM Attribute |
|---|---|
| constant Google Cloud Platform | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
id | UID |
references | REFERENCES |
summary | DESCRIPTION |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
| updated_at | SOURCE_LAST_MODIFIED |
url | URL |
Github
| Source Field Name | SDM Attribute |
|---|---|
classification | CLASSIFICATION |
| constant GitHub | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
cwes.nodes[].CWEId | WEAKNESSES |
description | DESCRIPTION |
ghsaId | UID |
permalink | URL |
publishedAt | PUBLISHED_DATE |
references[].url | REFERENCES |
severity | SOURCE_SEVERITY |
summary | NAME |
sync time (connector-generated) | LAST_CAPTURED |
updatedAt | SOURCE_LAST_MODIFIED |
vulnerabilities.nodes[].package.name | AFFECTED |
Hp
| Source Field Name | SDM Attribute |
|---|---|
| constant HP | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| Id | UID |
| Link | URL |
| Severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
Ibm
| Source Field Name | SDM Attribute |
|---|---|
| constant IBM | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of Url + Title + cve | UID |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
| Url | URL |
Intel
| Source Field Name | SDM Attribute |
|---|---|
| constant Intel | VENDOR |
| date_added | PUBLISHED_DATE |
| Id | UID |
| Summary | DESCRIPTION |
| Summary | URL |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
Kubernetes
| Source Field Name | SDM Attribute |
|---|---|
| constant Kubernetes | VENDOR |
content | DESCRIPTION |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| issue_id | UID |
summary | NAME |
sync time (connector-generated) | LAST_CAPTURED |
url | URL |
Linux
| Source Field Name | SDM Attribute |
|---|---|
| constant Linux | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of title + date_added | UID |
summary | DESCRIPTION |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
url | URL |
Microsoft CVRF
| Source Field Name | SDM Attribute |
|---|---|
"Microsoft " + cvrf.DocumentTracking.identification.id | NAME |
| constant Microsoft | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
cvrf.DocumentTracking.CurrentReleaseDate | SOURCE_LAST_MODIFIED |
cvrf.DocumentTracking.identification.id.Value | UID |
date_added, then cvrf.DocumentTracking.InitialReleaseDate | PUBLISHED_DATE |
sync time (connector-generated) | LAST_CAPTURED |
url | URL |
Mongodb
| Source Field Name | SDM Attribute |
|---|---|
| constant MongoDB | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| Description | DESCRIPTION |
| MD5 of Title + date_added | UID |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
| Url | URL |
Mozilla
| Source Field Name | SDM Attribute |
|---|---|
affected_components[] | AFFECTED_COMPONENT |
bugzilla | BUGZILLA |
| constant Mozilla | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| fixed_in | FIXED_IN |
impact | IMPACT |
products | AFFECTED |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
url | UID |
url | URL |
Netgear
| Source Field Name | SDM Attribute |
|---|---|
| constant Netgear | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of title + date_added | UID |
products | AFFECTED |
| psvn_number | PSVN_NUMBER |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
url | URL |
Oracle
| Source Field Name | SDM Attribute |
|---|---|
advisory.issued.Date | PUBLISHED_DATE |
| constant Oracle | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
description | RECOMMENDATION |
packages[].name | AFFECTED |
sync time (connector-generated) | LAST_CAPTURED |
title | UID |
title | NAME |
PaloAlto
| Source Field Name | SDM Attribute |
|---|---|
| Affected | AFFECTED |
| ApplicableVersions | APPLICABLE_VERSION |
| constant Palo Alto Networks | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| DatePublished, then date_added | PUBLISHED_DATE |
| DateUpdated | SOURCE_LAST_MODIFIED |
| ID | UID |
| Problem | DESCRIPTION |
| Product | PRODUCTS |
| Severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
| Unaffected | UNAFFECTED |
| Url | URL |
| Workaround, then Solution | RECOMMENDATION |
PostgreSql
| Source Field Name | SDM Attribute |
|---|---|
| constant PostgreSQL | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of title + date_added | UID |
pg_fix[].affected | AFFECTED |
pg_fix[].fixed | PG_FIX_FIXED |
summary | DESCRIPTION |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
url | URL |
Redhat
| Source Field Name | SDM Attribute |
|---|---|
advisories | ADVISORIES |
| advisory ID parsed from resource_url, prefixed Red Hat | NAME |
affected_release[] | AFFECTED |
bugzilla | BUGZILLA |
| bugzilla_description | DESCRIPTION |
| constant Red Hat | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
cwe | WEAKNESSES / CWE_IDS |
packages[].name | PACKAGES |
| public_date | PUBLISHED_DATE |
| resource_url | UID |
| resource_url | URL |
severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
Suse
| Source Field Name | SDM Attribute |
|---|---|
constant SUSE S.A | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
Notes[Type=Details].Text | DESCRIPTION |
Notes[Type=Summary].Text | SUMMARY |
References[].URL | REFERENCES |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
Tracking.CurrentReleaseDate | SOURCE_LAST_MODIFIED |
Tracking.ID | UID |
Tracking.InitialReleaseDate | PUBLISHED_DATE |
Ubuntu
| Source Field Name | SDM Attribute |
|---|---|
| "Ubuntu " + ubuntu_url | NAME |
affected_packages[].package_name | AFFECTED |
| constant Ubuntu | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of ubuntu_url | UID |
| reference_urls | REFERENCES |
| source_url | SOURCE_URL |
status | SOURCE_STATUS |
sync time (connector-generated) | LAST_CAPTURED |
| ubuntu_url | URL |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
CVE
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of CVE on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/vulncheck-nvd2
CWE
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of CWE on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/cwe
CPE
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of CPE on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/vc-cpe-dictionary
CPE Match
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of CPE Match on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/nist-nvd2-cpematch
EOL Advisory
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of EOL Advisory on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/eol
MITRE ATT&CK CVE
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of MITRE ATT&CK CVE on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/mitre-attack-cve
Adobe
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Adobe on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/adobe
Chrome
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Chrome on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/chrome
Cisco
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Cisco on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/cisco
Citrix
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Citrix on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/citrix
Dell
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Dell on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/dell
Fedora
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Fedora on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/fedora
Gcp
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Gcp on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/gcp
Github
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Github on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/github-security-advisories
Hp
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Hp on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/hp
Ibm
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Ibm on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/ibm
Intel
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Intel on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/intel
- The connector populates
URLfrom the advisorySummaryfield rather thanLink, so this attribute does not currently hold the advisory URL. - Intel advisories do not populate
CVE_RECORDS/CVE_IDS.
Kubernetes
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Kubernetes on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/kubernetes
Linux
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Linux on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/linux
Microsoft CVRF
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Microsoft CVRF on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/microsoft-cvrf
- The connector builds
NAMEfrom the CVRF identificationidobject rather than itsValuefield, so the emitted name currently includes the wrapper's string form rather than a bare document ID.
Mongodb
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Mongodb on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/mongodb
Mozilla
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Mozilla on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/mozilla
Netgear
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Netgear on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/netgear
Oracle
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Oracle on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/oracle
PaloAlto
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of PaloAlto on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/palo-alto
PostgreSql
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of PostgreSql on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/postgressql
Redhat
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Redhat on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/redhat
Suse
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Suse on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/suse
Ubuntu
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Ubuntu on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/ubuntu
Changelog
The VulnCheck connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.23 | New Features - Cve: Added the exploit-intelligence timeline dates VulnCheck reports for a CVE, so you can build time-based exploitation rules and age out threat signals from the date the activity was actually observed rather than from when the record was synced: - FIRST_EXPLOIT_PUBLISHED and MOST_RECENT_EXPLOIT_PUBLISHED — when the first and the most recent exploit for the CVE were published. - FIRST_EXPLOIT_PUBLISHED_WEAPONIZED — when the first exploit at weaponized maturity or higher was published. - FIRST_REPORTED_RANSOMWARE and MOST_RECENT_REPORTED_RANSOMWARE — when exploitation by ransomware was first and most recently reported. - FIRST_REPORTED_BOTNET and MOST_RECENT_REPORTED_BOTNET — when exploitation by a botnet was first and most recently reported. - FIRST_REPORTED_VULNCHECK_CANARIES — when exploitation was first observed by VulnCheck canaries. Previously only the two threat-actor timeline dates were captured and every other date in VulnCheck's exploit timeline was discarded, so ransomware and exploit-publication activity had no date to reason about. A CVE for which VulnCheck reports no date for a given signal leaves that field empty. | N/A |
| 3.0.22 | New Features - All models: Added a LAST_CAPTURED attribute to every model. - Each record now carries the timestamp of the sync in which it was last captured, making it easy to identify stale records that VulnCheck no longer reports. | N/A |
| 3.0.21 | Bug Fixes - Mozilla: A Mozilla advisory with a missing advisory URL no longer causes the Mozilla sync to fail. Such records are now skipped so the remaining advisories sync successfully. - CPE and CPE Match: A CPE name with fewer than the full set of CPE 2.3 components no longer causes the CPE and CPE Match syncs to fail. The components that are present are parsed, and any missing trailing components are left empty. - Large exports: Syncing large VulnCheck data exports no longer risks exhausting memory and failing with an out-of-memory error. Export files are now read and processed one record at a time instead of loading an entire export into memory at once, so large indexes sync reliably. Improvements Dependency Upgrades Upgraded internal framework, model, and storage libraries to the latest stable versions for improved reliability and security patches. | N/A |
| 3.0.20 | New Features - Cve: Added CISA Vulnrichment SSVC decision points so you can drive SSVC-based risk scoring and BOD 26-04 remediation-SLA rules directly in Brinqa: - CISA_AUTOMATABLE — whether an adversary can automate exploitation end-to-end. - CISA_TECHNICAL_IMPACT — the degree of control gained on successful exploitation (PARTIAL or TOTAL). - CISA_EXPLOITATION — CISA's exploitation status (NONE, POC, or ACTIVE). These values reflect CISA's official Vulnrichment assessment. CVEs that CISA has not yet enriched leave these fields empty. | N/A |
| 3.0.19 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.18 | New Features - Added a Preferred CVSS V3 source configuration property. When a CVE has CVSS v3 scores from multiple authorities, you can now choose which source (for example NIST or CISA-ADP) the connector uses, so the CVSS v3 vector, score, and severity reflect your preferred scoring authority. | • Cve: The selected CVSS v3 source now drives the stored CVSS v3 vector, score, and sub-metrics, so those values may change for CVEs that carry scores from more than one authority — Action: re-sync the VulnCheck connector to refresh CVSS v3 values. |
| 3.0.17 | New Features - Ubuntu advisories now include the source advisory URL, affected packages, and upstream/break/fix commit references, giving fuller context on each Ubuntu security notice. | • Ubuntu: The identifier for Ubuntu advisories is now derived from the advisory URL alone (the publish date is no longer part of the identifier), which changes the identity of existing Ubuntu records — Action: purge existing Ubuntu records and re-sync the VulnCheck connector. |
| 3.0.16 | Improvements - CVE records now carry the originating vendor. - Palo Alto advisories now include associated CWE identifiers and weakness descriptions. - CPE Match records now include a status value. | N/A |
| 3.0.15 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.14 | New Features - Added support for CVSS v4 metrics on CVE records, including the CVSS v4 vector source, so CVEs scored with CVSS v4 are now represented in Brinqa. Improvements - Hardened CVSS metric parsing so CVEs with missing or empty metric blocks are processed reliably. | N/A |
| 3.0.13 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.12 | New Features - CVE records now indicate whether the vulnerability appears in the CISA Known Exploited Vulnerabilities (KEV) catalog and the date it was added. | N/A |
| 3.0.11 | Improvements - Mozilla advisories now present affected-component details (title, description, impact, reporter, and Bugzilla references) as readable, consolidated text. Bug Fixes - Corrected how the CWE weakness export is read so weaknesses are imported reliably. | N/A |
| 3.0.10 | Improvements - CPE dictionary records are now emitted per individual CPE entry and expanded into their full set of CPE 2.3 components (edition, language, software edition, target hardware, target software, update, vendor, and others), providing finer-grained and more complete CPE data. | • Cpe: CPE records are now keyed per individual CPE (rather than per base CPE) and the multi-valued PRODUCT_VERSIONS attribute was replaced by a single-valued PRODUCT_VERSION, changing both record identity and stored values — Action: purge existing CPE records and re-sync the VulnCheck connector. |
| 3.0.9 | New Features - Added a new CPE Match model that synchronizes CPE-match records from the NVD CPE-match index, broadening the CPE coverage available in Brinqa. | N/A |
| 3.0.8 | Bug Fixes - EPSS score and EPSS percentile on CVE records are now expressed as percentages (for example, 0.0038 is now stored as 0.38), making the values consistent with how EPSS is normally presented. | • Cve: EPSS score and EPSS percentile values are rescaled to percentages, so previously stored values will differ — Action: re-sync the VulnCheck connector to refresh EPSS values. |
| 3.0.7 | New Features - CVE records now include associated weakness descriptions and the CISA vulnerability name. Improvements - Clarified the CISA-exploited indicator on CVE records. | • Cve: The CISA-exploited indicator was renamed from IN_KEV to CISA_EXPLOITED, changing the attribute key for that value — Action: re-sync the VulnCheck connector to populate the renamed attribute. |
| 3.0.6 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.5 | Bug Fixes - Stopped populating the CVE alias field with the CISA required-action text, which had been incorrectly stored as an alias. | • Cve: The alias field no longer receives the CISA required-action text, so previously stored incorrect aliases should be cleared — Action: re-sync the VulnCheck connector to refresh CVE alias values. |
| 3.0.4 | Bug Fixes - Fixed parsing of Microsoft CVRF advisory identifiers so advisory IDs are read correctly. | N/A |
| 3.0.3 | Bug Fixes - Corrected the attack-techniques attribute mapping on CVE records so related MITRE ATT&CK technique references resolve to the proper target. | • Cve: The attack-techniques mapping target was corrected, changing how those references are stored — Action: re-sync the VulnCheck connector to refresh CVE attack-technique values. |
| 3.0.2 | Bug Fixes - Fixed the first-reported and last-reported threat-actor dates on CVE records, which were previously stored in an incorrect format. | • Cve: First-reported and last-reported threat-actor date values are corrected, so previously stored values will differ — Action: re-sync the VulnCheck connector to refresh these dates. |
| 3.0.1 | Improvements - CVE records now include the CVSS v3 temporal score. - CWE records now include a status value. - Dell advisories now include associated CVE identifiers. - GitHub advisories now include affected products. - Oracle advisories now include the publishing vendor. | N/A |
| 3.0.0 | Overview The VulnCheck connector integrates with the VulnCheck threat-intelligence platform to synchronize vulnerability, exploit, and security-advisory intelligence into Brinqa. It ingests VulnCheck's data exports — including enriched CVE records, CWE weaknesses, CPE records, end-of-life advisories, MITRE ATT&CK techniques, and security advisories from more than twenty vendors. Category: Threat Intelligence Models | N/A |