VulnCheck
Threat Intelligence- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The VulnCheck Connector integrates with the VulnCheck threat-intelligence platform and synchronizes vulnerability and exploit intelligence into Brinqa. It downloads VulnCheck's data export ("backup") indices over HTTPS and maps them to Brinqa UDM models, including:
- CVE records enriched with NVD data, EPSS scores, CISA KEV / VulnCheck KEV details, CISA Vulnrichment SSVC decision points, exploit/weaponization signals, Microsoft KB threat data, and MITRE ATT&CK technique references.
- CWE weaknesses from the MITRE CWE catalog.
- CPE records from the VulnCheck CPE dictionary and the NVD CPE-match index.
- EOL advisories describing end-of-life product releases.
- MITRE ATT&CK techniques correlated to CVEs.
- Vendor security advisories from more than twenty publishers (Adobe, Chrome, Cisco, Citrix, Dell, Fedora, GCP, GitHub, HP, IBM, Intel, Kubernetes, Linux, Microsoft, MongoDB, Mozilla, Netgear, Oracle, Palo Alto, PostgreSQL, Red Hat, SUSE, Ubuntu).
Each VulnCheck index is fetched as a ZIP archive, decompressed (some entries are further GZIP-compressed), parsed as JSON, and mapped to connector objects.
Data retrieved from VulnCheck
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| CVE | Yes | Cve Record |
| CWE | Yes | Weakness |
| CPE | Yes | Cpe Record |
| CPE Match | Yes | Cpe Record |
| EOL Advisory | Yes | Eol Advisory |
| MITRE ATT&CK CVE | Yes | Attack Technique |
| Adobe | Yes | Security Advisory |
| Chrome | Yes | Security Advisory |
| Cisco | Yes | Security Advisory |
| Citrix | Yes | Security Advisory |
| Dell | Yes | Security Advisory |
| Fedora | Yes | Security Advisory |
| Gcp | Yes | Security Advisory |
| Github | Yes | Security Advisory |
| Hp | Yes | Security Advisory |
| Ibm | Yes | Security Advisory |
| Intel | Yes | Security Advisory |
| Kubernetes | Yes | Security Advisory |
| Linux | Yes | Security Advisory |
| Microsoft CVRF | Yes | Security Advisory |
| Mongodb | Yes | Security Advisory |
| Mozilla | Yes | Security Advisory |
| Netgear | Yes | Security Advisory |
| Oracle | Yes | Security Advisory |
| PaloAlto | Yes | Security Advisory |
| PostgreSql | Yes | Security Advisory |
| Redhat | Yes | Security Advisory |
| Suse | Yes | Security Advisory |
| Ubuntu | Yes | Security Advisory |
Model relationships
For detailed steps on how to view the data retrieved from VulnCheck in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select VulnCheck from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Api URL | No | — | VulnCheck api url |
| Api token | No | — | VulnCheck api token |
| Preferred CVSS V3 source | No | — | Select which CVSS v3 authority should be used when multiple scores are available (NIST or CISA-ADP) |
Authentication
The connector authenticates to the VulnCheck API using a Bearer token (API token). The token is supplied as a configuration property and sent on every request in the Authorization header.
Endpoints
| Method | URL | Purpose |
|---|---|---|
| GET | {Api URL}/v3/index | Connection test (used by the connector's test operation). |
| GET | {Api URL}/v3/backup/{index} | Retrieve the download URL(s) for a data export index (e.g. vulncheck-nvd2, cwe, exploits, adobe). |
| GET | {download URL} | Download the ZIP export referenced by the backup index response. |
The default Api URL is https://api.vulncheck.com.
Request Headers
| Header | Value |
|---|---|
Authorization | Bearer {API token} |
User-Agent | Integration/1.0 (Brinqa; VulnCheck Connector; Build/{version}) |
X-Requested-With | brinqa (sent on export download requests) |
Sample Request
GET /v3/backup/vulncheck-nvd2 HTTP/1.1
Host: api.vulncheck.com
Authorization: Bearer <api-token>
Sample Response
The backup index response returns one or more time-stamped download URLs for the requested export:
{
"_benchmark": 0.123,
"_meta": { "timestamp": "2024-04-12T12:51:59Z" },
"data": [
{
"url": "https://storage.googleapis.com/vulncheck-backups/vulncheck-nvd2-2024-04-12.zip",
"date_added": "2024-04-12T00:00:00Z"
}
]
}
Response Fields
| Field | Description |
|---|---|
data | List of available export files for the index. |
data[].url | Signed URL of the ZIP export to download. |
data[].date_added | Timestamp the export file was produced. |
Using the Token
The API token is configured once and is automatically attached to every outgoing request as Authorization: Bearer {token}. The same token is used both for retrieving the backup index URLs and for downloading the referenced export archives.
Sync Behavior
Each sync is a full sync. Every run fetches the export index, downloads the referenced archive, and processes every record. A since (Instant) sync token is accepted by the sync operation, but the VulnCheck backup exports are full snapshots, so the connector re-processes the complete export each time rather than applying an incremental time filter. The latest sync token is not tracked (getLatestSyncToken returns null).
How to obtain VulnCheck credentials
Obtain the required credentials (Api URL, Api token) from your VulnCheck administrator or the VulnCheck admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
CVE
| Source Field Name | SDM Attribute |
|---|---|
| ALIAS | ALIAS |
categorization.tags | TAGS |
| cisa_date_added | CISA_KEV_DATE |
cisaActionDue | CISA_DUE_DATE |
cisaRequiredAction | CISA_REQUIRED_ACTION |
| commercial_exploit_found | COMMERCIAL_EXPLOIT |
| date_added | SOURCE_CREATED_DATE |
| derived from cisa_date_added | IN_CISA_KEV |
| derived from selected CVSS v2/v3/v4 vector strings | (CVSS base/temporal metrics) |
descriptions[lang=en].value | DESCRIPTION |
id | NAME |
id (vulncheck-nvd2) | UID |
inKEV | CISA_EXPLOITED |
inVCKEV | IN_VCKEV |
knownRansomwareCampaignUse (vulncheck-kev) | KNOWN_ACTIVE_RANSOMWARE_CAMPAIGN |
lastModified | SOURCE_LAST_MODIFIED |
| max_exploit_maturity | EXPLOIT_MATURITY |
metrics.cvssMetricV2[].source | CVSS_V2_BASE_VECTOR_SOURCE |
metrics.cvssMetricV31[].source | CVSS_V3_BASE_VECTOR_SOURCE |
metrics.cvssMetricV31[].source | CVSS_V3_TEMPORAL_VECTOR_SOURCE |
metrics.cvssMetricV40[].source | CVSS_V4_VECTOR_SOURCE |
metrics.epss.epss_percentile | EPSS_PERCENTILE |
metrics.epss.epss_score | EPSS_SCORE |
metrics.epss.last_modified | EPSS_LAST_MODIFIED |
metrics.ssvc[source=CISA-ADP].automatable | CISA_AUTOMATABLE |
metrics.ssvc[source=CISA-ADP].exploitation | CISA_EXPLOITATION |
metrics.ssvc[source=CISA-ADP].technicalImpact | CISA_TECHNICAL_IMPACT |
metrics.temporalCvssV2Secondary[].source | CVSS_V2_TEMPORAL_VECTOR_SOURCE |
mitreAttackTechniques[].id | ATTACK_TECHNIQUES |
public_exploit_found (exploits) | PUBLIC_EXPLOIT |
published | PUBLISHED_DATE |
references[] | REFERENCES |
relatedAttackPatterns[].capec_id | ATTACK_PATTERNS |
| reported_exploited | REPORTED_EXPLOITED |
| reported_exploited_by_botnets | USED_BY_BOTNETS |
| reported_exploited_by_ransomware | USED_BY_RANSOMWARE |
| reported_exploited_by_threat_actors | USED_BY_THREAT_ACTORS |
| required_action | RECOMMENDATION |
shortDescription | SUMMARY |
sourceIdentifier | SOURCE_IDENTIFIER |
sync time (connector-generated) | LAST_CAPTURED |
threat.dos | DOS |
threat.exploited | THREAT_EXPLOITED |
threat.latest_software_release | THREAT_LATEST_SOFTWARE_RELEASE |
threat.level | THREAT_LEVEL |
threat.older_software_release | THREAT_OLDER_SOFTWARE_RELEASE |
threat.publicly_disclosed | THREAT_PUBLICLY_DISCLOSED |
threat.type (microsoft-kb) | THREAT_TYPE |
timeline.first_exploit_published | FIRST_EXPLOIT_PUBLISHED |
timeline.first_exploit_published_weaponized_or_higher | FIRST_EXPLOIT_PUBLISHED_WEAPONIZED |
timeline.first_reported_botnet | FIRST_REPORTED_BOTNET |
timeline.first_reported_ransomware | FIRST_REPORTED_RANSOMWARE |
timeline.first_reported_threat_actor | FIRST_REPORTED_THREAT_ACTOR |
timeline.first_reported_vulncheck_canaries | FIRST_REPORTED_VULNCHECK_CANARIES |
timeline.most_recent_exploit_published | MOST_RECENT_EXPLOIT_PUBLISHED |
timeline.most_recent_reported_botnet | MOST_RECENT_REPORTED_BOTNET |
timeline.most_recent_reported_ransomware | MOST_RECENT_REPORTED_RANSOMWARE |
timeline.most_recent_reported_threat_actor | LAST_REPORTED_THREAT_ACTOR |
trending.github | GITHUB_TRENDING |
| vulncheckKEVExploitAdd / cisaExploitAdd | CISA_ADDED_DATE |
vulnerabilityName (vulncheck-kev) / cisaVulnerabilityName (vulncheck-nvd2) | CISA_VULNERABILITY_NAME |
vulnerableCPEs | AFFECTED / CPE_RECORDS |
vulnStatus | SOURCE_STATUS |
weaknesses[].description[lang=en].value | CWE_IDS / WEAKNESSES |
| weaponized_exploit_found | WEAPONIZED_EXPLOIT |
CWE
| Source Field Name | SDM Attribute |
|---|---|
abstraction | ABSTRACTION |
| CWE- + weakness_id | UID |
description | DESCRIPTION |
| kev_count | KEV_COUNT |
status | STATUS |
structure | STRUCTURE |
sync time (connector-generated) | LAST_CAPTURED |
| vulncheck_nvd_count | VULN_CHECK_NVD_COUNT |
weakness_name (falls back to UID) | NAME |
| weighted_score | WEIGHTED_SCORE |
CPE
| Source Field Name | SDM Attribute |
|---|---|
| parsed from CPE | NAME |
| parsed from CPE | VERSION |
| parsed from CPE | PART |
| parsed from CPE | VENDOR |
| parsed from CPE | PRODUCT |
| parsed from CPE | EDITION |
| parsed from CPE | LANG |
| parsed from CPE | OTHER |
| parsed from CPE | SOFTWARE_EDITION |
| parsed from CPE | TARGET_HARDWARE |
| parsed from CPE | TARGET_SOFTWARE |
| parsed from CPE | UPDATE |
sync time (connector-generated) | LAST_CAPTURED |
versions[] | UID / BASE_CPE_NAME |
CPE Match
| Source Field Name | SDM Attribute |
|---|---|
created | SOURCE_CREATED_DATE |
criteria | UID |
| lastModified / cpeLastModified | SOURCE_LAST_MODIFIED |
matchCriteriaId | MATCH_CRITERIA_ID |
| parsed from criteria | NAME |
| parsed from criteria | PART |
| parsed from criteria | VENDOR |
| parsed from criteria | PRODUCT |
| parsed from criteria | VERSION |
| parsed from criteria | UPDATE |
| parsed from criteria | EDITION |
| parsed from criteria | LANG |
| parsed from criteria | SOFTWARE_EDITION |
| parsed from criteria | TARGET_SOFTWARE |
| parsed from criteria | TARGET_HARDWARE |
| parsed from criteria | OTHER |
status | STATUS |
sync time (connector-generated) | LAST_CAPTURED |
EOL Advisory
| Source Field Name | SDM Attribute |
|---|---|
| already_eol | IS_EOL |
cpe | CPE_RECORDS |
| eol_date | EOL_DATE |
| MD5 of source_url + cpe | UID |
product | PRODUCT |
| release_date | RELEASE_DATE |
| release_name | NAME |
| source_url | URL |
sync time (connector-generated) | LAST_CAPTURED |
vendor | VENDOR |
MITRE ATT&CK CVE
| Source Field Name | SDM Attribute |
|---|---|
| cve_list | CVE_RECORDS / CVE_IDS |
derived from technique_id.id | PARENT_TECHNIQUE |
sync time (connector-generated) | LAST_CAPTURED |
technique_id.domain | DOMAIN |
technique_id.id | UID |
technique_id.name | NAME |
technique_id.subtechnique | SUB_TECHNIQUE |
technique_id.tactics | TACTICS |
technique_id.url | URL |
Adobe
| Source Field Name | SDM Attribute |
|---|---|
| "Adobe " + UID | NAME |
Affected[].Product / .Version / .Platform | AFFECTED |
| BulletinId | UID |
| constant Adobe | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| Link | URL |
Solutions[] | RECOMMENDATION |
sync time (connector-generated) | LAST_CAPTURED |
Chrome
| Source Field Name | SDM Attribute |
|---|---|
| constant Google Chrome | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of Title + date_added | UID |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
| Url | URL |
Cisco
| Source Field Name | SDM Attribute |
|---|---|
ciscoBugId | CISCO_BUG_ID |
| constant Cisco | VENDOR |
csaf | CSAF |
cve | CVE_RECORDS / CVE_IDS |
cvrf | CVRF |
cwe | WEAKNESSES / CWE_IDS |
| date_added | PUBLISHED_DATE |
identifier | UID |
name | CISCO_NAME |
severity | SOURCE_SEVERITY |
status | SOURCE_STATUS |
summary | DESCRIPTION |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
version | CURRENT_VERSION |
workarounds | WORK_AROUNDS |
workflowStatus | WORK_FLOW_STATUS |
Citrix
| Source Field Name | SDM Attribute |
|---|---|
| CitrixId | UID |
| constant Citrix | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| Link | URL |
| Products | AFFECTED |
| Severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
Dell
| Source Field Name | SDM Attribute |
|---|---|
| CombinedProductList | AFFECTED |
| constant Dell | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| Severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
| Url | UID |
| Url | URL |
Fedora
| Source Field Name | SDM Attribute |
|---|---|
| constant Fedora | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
id | UID |
issued.Date | PUBLISHED_DATE |
| os_arch | OS_ARCH |
| os_version | OS_VERSION |
packages[] | AFFECTED |
references[] | REFERENCES |
severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
type | TYPE |
updated.Date | SOURCE_LAST_MODIFIED |
Gcp
| Source Field Name | SDM Attribute |
|---|---|
| constant Google Cloud Platform | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
id | UID |
references | REFERENCES |
summary | DESCRIPTION |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
| updated_at | SOURCE_LAST_MODIFIED |
url | URL |
Github
| Source Field Name | SDM Attribute |
|---|---|
classification | CLASSIFICATION |
| constant GitHub | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
cwes.nodes[].CWEId | WEAKNESSES |
description | DESCRIPTION |
ghsaId | UID |
permalink | URL |
publishedAt | PUBLISHED_DATE |
references[].url | REFERENCES |
severity | SOURCE_SEVERITY |
summary | NAME |
sync time (connector-generated) | LAST_CAPTURED |
updatedAt | SOURCE_LAST_MODIFIED |
vulnerabilities.nodes[].package.name | AFFECTED |
Hp
| Source Field Name | SDM Attribute |
|---|---|
| constant HP | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| Id | UID |
| Link | URL |
| Severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
Ibm
| Source Field Name | SDM Attribute |
|---|---|
| constant IBM | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of Url + Title + cve | UID |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
| Url | URL |
Intel
| Source Field Name | SDM Attribute |
|---|---|
| constant Intel | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| Id | UID |
| Link | URL |
| Summary | DESCRIPTION |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
Kubernetes
| Source Field Name | SDM Attribute |
|---|---|
| constant Kubernetes | VENDOR |
content | DESCRIPTION |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| issue_id | UID |
summary | NAME |
sync time (connector-generated) | LAST_CAPTURED |
url | URL |
Linux
| Source Field Name | SDM Attribute |
|---|---|
| constant Linux | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of title + date_added | UID |
summary | DESCRIPTION |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
url | URL |
Microsoft CVRF
| Source Field Name | SDM Attribute |
|---|---|
"Microsoft " + cvrf.DocumentTracking.identification.id.Value | NAME |
| constant Microsoft | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
cvrf.DocumentTracking.CurrentReleaseDate | SOURCE_LAST_MODIFIED |
cvrf.DocumentTracking.identification.id.Value | UID |
date_added, then cvrf.DocumentTracking.InitialReleaseDate | PUBLISHED_DATE |
sync time (connector-generated) | LAST_CAPTURED |
url | URL |
Mongodb
| Source Field Name | SDM Attribute |
|---|---|
| constant MongoDB | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| Description | DESCRIPTION |
| MD5 of Title + date_added | UID |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
| Url | URL |
Mozilla
| Source Field Name | SDM Attribute |
|---|---|
affected_components[] | AFFECTED_COMPONENT |
bugzilla | BUGZILLA |
| constant Mozilla | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| fixed_in | FIXED_IN |
impact | IMPACT |
products | AFFECTED |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
url | UID |
url | URL |
Netgear
| Source Field Name | SDM Attribute |
|---|---|
| constant Netgear | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of title + date_added | UID |
products | AFFECTED |
| psvn_number | PSVN_NUMBER |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
url | URL |
Oracle
| Source Field Name | SDM Attribute |
|---|---|
advisory.issued.Date | PUBLISHED_DATE |
| constant Oracle | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
description | RECOMMENDATION |
packages[].name | AFFECTED |
sync time (connector-generated) | LAST_CAPTURED |
title | UID |
title | NAME |
PaloAlto
| Source Field Name | SDM Attribute |
|---|---|
| Affected | AFFECTED |
| ApplicableVersions | APPLICABLE_VERSION |
| constant Palo Alto Networks | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| DatePublished, then date_added | PUBLISHED_DATE |
| DateUpdated | SOURCE_LAST_MODIFIED |
| ID | UID |
| Problem | DESCRIPTION |
| Product | PRODUCTS |
| Severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
| Unaffected | UNAFFECTED |
| Url | URL |
| Workaround, then Solution | RECOMMENDATION |
PostgreSql
| Source Field Name | SDM Attribute |
|---|---|
| constant PostgreSQL | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of title + date_added | UID |
pg_fix[].affected | AFFECTED |
pg_fix[].fixed | PG_FIX_FIXED |
summary | DESCRIPTION |
sync time (connector-generated) | LAST_CAPTURED |
title | NAME |
url | URL |
Redhat
| Source Field Name | SDM Attribute |
|---|---|
advisories | ADVISORIES |
| advisory ID parsed from resource_url, prefixed Red Hat | NAME |
affected_release[] | AFFECTED |
bugzilla | BUGZILLA |
| bugzilla_description | DESCRIPTION |
| constant Red Hat | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
cwe | WEAKNESSES / CWE_IDS |
packages[].name | PACKAGES |
| public_date | PUBLISHED_DATE |
| resource_url | UID |
| resource_url | URL |
severity | SOURCE_SEVERITY |
sync time (connector-generated) | LAST_CAPTURED |
Suse
| Source Field Name | SDM Attribute |
|---|---|
constant SUSE S.A | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
Notes[Type=Details].Text | DESCRIPTION |
Notes[Type=Summary].Text | SUMMARY |
References[].URL | REFERENCES |
sync time (connector-generated) | LAST_CAPTURED |
| Title | NAME |
Tracking.CurrentReleaseDate | SOURCE_LAST_MODIFIED |
Tracking.ID | UID |
Tracking.InitialReleaseDate | PUBLISHED_DATE |
Ubuntu
| Source Field Name | SDM Attribute |
|---|---|
| "Ubuntu " + ubuntu_url | NAME |
affected_packages[].package_name | AFFECTED |
| constant Ubuntu | VENDOR |
cve | CVE_RECORDS / CVE_IDS |
| date_added | PUBLISHED_DATE |
| MD5 of ubuntu_url | UID |
| reference_urls | REFERENCES |
| source_url | SOURCE_URL |
status | SOURCE_STATUS |
sync time (connector-generated) | LAST_CAPTURED |
| ubuntu_url | URL |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
CVE
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of CVE on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/vulncheck-nvd2
CWE
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of CWE on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/cwe
CPE
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of CPE on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/vc-cpe-dictionary
CPE Match
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of CPE Match on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/nist-nvd2-cpematch
EOL Advisory
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of EOL Advisory on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/eol
MITRE ATT&CK CVE
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of MITRE ATT&CK CVE on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/mitre-attack-cve
Adobe
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Adobe on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/adobe
Chrome
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Chrome on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/chrome
Cisco
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Cisco on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/cisco
Citrix
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Citrix on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/citrix
Dell
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Dell on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/dell
Fedora
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Fedora on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/fedora
Gcp
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Gcp on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/gcp
Github
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Github on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/github-security-advisories
Hp
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Hp on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/hp
Ibm
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Ibm on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/ibm
Intel
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Intel on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/intel
Kubernetes
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Kubernetes on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/kubernetes
Linux
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Linux on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/linux
Microsoft CVRF
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Microsoft CVRF on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/microsoft-cvrf
Mongodb
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Mongodb on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/mongodb
Mozilla
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Mozilla on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/mozilla
Netgear
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Netgear on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/netgear
Oracle
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Oracle on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/oracle
PaloAlto
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of PaloAlto on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/palo-alto
PostgreSql
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of PostgreSql on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/postgressql
Redhat
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Redhat on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/redhat
Suse
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Suse on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/suse
Ubuntu
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Ubuntu on every run and applies no incremental date filter.
API
- Type: REST endpoint (backup export) · Endpoint:
GET /v3/backup/ubuntu
Changelog
The VulnCheck connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.25 | Improvements - Data exports: Records that could not be read, and export files that could not be read at all, are now reported to Brinqa as connector events as well as to the connector log, so these problems are visible in the platform instead of only to someone reading the connector's log. At most ten events of each kind are sent per sync however many records or files are affected, so a systemic problem cannot flood the platform; the log continues to report the exact totals. The log's own limit on individually listed skipped records now applies per export rather than per export file. | N/A |
| 3.0.24 | Improvements - Microsoft CVRF: The advisory document ID is now accepted whether the export spells its JSON key Value or value. Current exports use Value, so this is a safeguard against a future change in the export format rather than a fix for anything observed in the data today. - Data exports: Records skipped during a data export are now reported with a count, and the log identifies the skipped records, up to a limit per export file, and why each could not be read. Parsing problems are also reported separately from decompression problems — previously both were logged as a decompression error, which pointed investigation at the download rather than at the record. Bug Fixes - Microsoft CVRF: Advisory names are now the plain document ID — Microsoft 2017-Feb — rather than the internal wrapper text Microsoft Id{value=2017-Feb} that every Microsoft CVRF advisory carried. Record identity is unchanged, so nothing is re-keyed; existing advisories pick up the corrected name on the next sync. - Cve: The CISA Vulnrichment SSVC decision points ( CISA_AUTOMATABLE, CISA_TECHNICAL_IMPACT, CISA_EXPLOITATION) are now populated. These attributes were added in 3.0.20 but were left empty on every CVE, so SSVC-based risk scoring and BOD 26-04 remediation-SLA rules had no values to work with. Existing CVE records pick the values up on the next sync. - Cve: The CISA_VULNERABILITY_NAME attribute is now populated with the CISA KEV vulnerability name VulnCheck reports for a CVE, and is now declared in the CVE schema so it is selectable in Brinqa. The value was previously discarded before it reached the record, so the attribute was empty on every CVE — including CVEs in CISA KEV where VulnCheck does supply a name — and any rule or report keyed on it matched nothing. Existing CVE records pick the value up on the next sync. - Cve: CISA_VULNERABILITY_NAME is now also read from the CVE's NVD record, so a CVE that VulnCheck's KEV index did not return in a given sync no longer leaves the attribute empty when the name was in the synced payload all along. Where both sources report a name, the VulnCheck KEV value is used. Existing CVE records pick the value up on the next sync. - Intel: The URL attribute now holds the advisory link. It was populated from the advisory summary instead, so every Intel advisory carried prose in URL — identical to DESCRIPTION — and anything linking out from an Intel advisory, or filtering and reporting on URL, had no usable link to work with. Existing Intel advisories pick up the corrected URL on the next sync. - Intel: Intel advisories now populate CVE_RECORDS and CVE_IDS, and both attributes are now declared in the Intel schema so they are selectable in Brinqa. The CVEs an Intel advisory references were present in the synced data but never mapped onto the record, so Intel was the only vendor-advisory model with no link to its CVEs, and rules or reports that traverse from an advisory to its CVEs skipped Intel entirely. Existing Intel advisories pick up the CVE links on the next sync. - Intel: An advisory that reports no identifier of its own no longer fails the Intel sync. The connector falls back to deriving the identifier from the advisory link, and that fallback assumed every link ends in a file name — so an ordinary advisory URL without one, a link ending in a slash, or a blank link aborted the whole Intel sync and no Intel advisories were synced at all. Such links are now handled, and an advisory supplying neither an identifier nor a usable link is skipped with a warning so the rest of the model still syncs. - Data exports: A single record the connector cannot read no longer stops the rest of a data export from syncing. One unreadable record previously ended that export file and every remaining file in the same download, so a sync could deliver a fraction of the available records — or none at all — while still reporting success, leaving the undelivered records indistinguishable from records VulnCheck had genuinely removed. Such a record is now skipped and the remaining records sync normally. This applies to every VulnCheck data export, including CVE, CPE, CPE Match and all of the vendor advisory indexes. - Data exports: A sync that cannot read part of a data export now fails instead of reporting success. A file that could not be decompressed or parsed previously ended the download and left every remaining file in it unread, and the sync still reported success — so an export that delivered part of its data, or none of it, looked identical to a clean run. Because the number of records lost that way is unknown, such a sync is now marked failed, so the records it never delivered are not mistaken for records VulnCheck removed and aged out of your data. | N/A |
| 3.0.23 | New Features - Cve: Added the exploit-intelligence timeline dates VulnCheck reports for a CVE, so you can build time-based exploitation rules and age out threat signals from the date the activity was actually observed rather than from when the record was synced: - FIRST_EXPLOIT_PUBLISHED and MOST_RECENT_EXPLOIT_PUBLISHED — when the first and the most recent exploit for the CVE were published. - FIRST_EXPLOIT_PUBLISHED_WEAPONIZED — when the first exploit at weaponized maturity or higher was published. - FIRST_REPORTED_RANSOMWARE and MOST_RECENT_REPORTED_RANSOMWARE — when exploitation by ransomware was first and most recently reported. - FIRST_REPORTED_BOTNET and MOST_RECENT_REPORTED_BOTNET — when exploitation by a botnet was first and most recently reported. - FIRST_REPORTED_VULNCHECK_CANARIES — when exploitation was first observed by VulnCheck canaries. Previously only the two threat-actor timeline dates were captured and every other date in VulnCheck's exploit timeline was discarded, so ransomware and exploit-publication activity had no date to reason about. A CVE for which VulnCheck reports no date for a given signal leaves that field empty. | N/A |
| 3.0.22 | New Features - All models: Added a LAST_CAPTURED attribute to every model. - Each record now carries the timestamp of the sync in which it was last captured, making it easy to identify stale records that VulnCheck no longer reports. | N/A |
| 3.0.21 | Bug Fixes - Mozilla: A Mozilla advisory with a missing advisory URL no longer causes the Mozilla sync to fail. Such records are now skipped so the remaining advisories sync successfully. - CPE and CPE Match: A CPE name with fewer than the full set of CPE 2.3 components no longer causes the CPE and CPE Match syncs to fail. The components that are present are parsed, and any missing trailing components are left empty. - Large exports: Syncing large VulnCheck data exports no longer risks exhausting memory and failing with an out-of-memory error. Export files are now read and processed one record at a time instead of loading an entire export into memory at once, so large indexes sync reliably. Improvements Dependency Upgrades Upgraded internal framework, model, and storage libraries to the latest stable versions for improved reliability and security patches. | N/A |
| 3.0.20 | New Features - Cve: Added CISA Vulnrichment SSVC decision points so you can drive SSVC-based risk scoring and BOD 26-04 remediation-SLA rules directly in Brinqa: - CISA_AUTOMATABLE — whether an adversary can automate exploitation end-to-end. - CISA_TECHNICAL_IMPACT — the degree of control gained on successful exploitation (PARTIAL or TOTAL). - CISA_EXPLOITATION — CISA's exploitation status (NONE, POC, or ACTIVE). These values reflect CISA's official Vulnrichment assessment. CVEs that CISA has not yet enriched leave these fields empty. | N/A |
| 3.0.19 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.18 | New Features - Added a Preferred CVSS V3 source configuration property. When a CVE has CVSS v3 scores from multiple authorities, you can now choose which source (for example NIST or CISA-ADP) the connector uses, so the CVSS v3 vector, score, and severity reflect your preferred scoring authority. | • Cve: The selected CVSS v3 source now drives the stored CVSS v3 vector, score, and sub-metrics, so those values may change for CVEs that carry scores from more than one authority — Action: re-sync the VulnCheck connector to refresh CVSS v3 values. |
| 3.0.17 | New Features - Ubuntu advisories now include the source advisory URL, affected packages, and upstream/break/fix commit references, giving fuller context on each Ubuntu security notice. | • Ubuntu: The identifier for Ubuntu advisories is now derived from the advisory URL alone (the publish date is no longer part of the identifier), which changes the identity of existing Ubuntu records — Action: purge existing Ubuntu records and re-sync the VulnCheck connector. |
| 3.0.16 | Improvements - CVE records now carry the originating vendor. - Palo Alto advisories now include associated CWE identifiers and weakness descriptions. - CPE Match records now include a status value. | N/A |
| 3.0.15 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.14 | New Features - Added support for CVSS v4 metrics on CVE records, including the CVSS v4 vector source, so CVEs scored with CVSS v4 are now represented in Brinqa. Improvements - Hardened CVSS metric parsing so CVEs with missing or empty metric blocks are processed reliably. | N/A |
| 3.0.13 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.12 | New Features - CVE records now indicate whether the vulnerability appears in the CISA Known Exploited Vulnerabilities (KEV) catalog and the date it was added. | N/A |
| 3.0.11 | Improvements - Mozilla advisories now present affected-component details (title, description, impact, reporter, and Bugzilla references) as readable, consolidated text. Bug Fixes - Corrected how the CWE weakness export is read so weaknesses are imported reliably. | N/A |
| 3.0.10 | Improvements - CPE dictionary records are now emitted per individual CPE entry and expanded into their full set of CPE 2.3 components (edition, language, software edition, target hardware, target software, update, vendor, and others), providing finer-grained and more complete CPE data. | • Cpe: CPE records are now keyed per individual CPE (rather than per base CPE) and the multi-valued PRODUCT_VERSIONS attribute was replaced by a single-valued PRODUCT_VERSION, changing both record identity and stored values — Action: purge existing CPE records and re-sync the VulnCheck connector. |
| 3.0.9 | New Features - Added a new CPE Match model that synchronizes CPE-match records from the NVD CPE-match index, broadening the CPE coverage available in Brinqa. | N/A |
| 3.0.8 | Bug Fixes - EPSS score and EPSS percentile on CVE records are now expressed as percentages (for example, 0.0038 is now stored as 0.38), making the values consistent with how EPSS is normally presented. | • Cve: EPSS score and EPSS percentile values are rescaled to percentages, so previously stored values will differ — Action: re-sync the VulnCheck connector to refresh EPSS values. |
| 3.0.7 | New Features - CVE records now include associated weakness descriptions and the CISA vulnerability name. Improvements - Clarified the CISA-exploited indicator on CVE records. | • Cve: The CISA-exploited indicator was renamed from IN_KEV to CISA_EXPLOITED, changing the attribute key for that value — Action: re-sync the VulnCheck connector to populate the renamed attribute. |
| 3.0.6 | Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.5 | Bug Fixes - Stopped populating the CVE alias field with the CISA required-action text, which had been incorrectly stored as an alias. | • Cve: The alias field no longer receives the CISA required-action text, so previously stored incorrect aliases should be cleared — Action: re-sync the VulnCheck connector to refresh CVE alias values. |
| 3.0.4 | Bug Fixes - Fixed parsing of Microsoft CVRF advisory identifiers so advisory IDs are read correctly. | N/A |
| 3.0.3 | Bug Fixes - Corrected the attack-techniques attribute mapping on CVE records so related MITRE ATT&CK technique references resolve to the proper target. | • Cve: The attack-techniques mapping target was corrected, changing how those references are stored — Action: re-sync the VulnCheck connector to refresh CVE attack-technique values. |
| 3.0.2 | Bug Fixes - Fixed the first-reported and last-reported threat-actor dates on CVE records, which were previously stored in an incorrect format. | • Cve: First-reported and last-reported threat-actor date values are corrected, so previously stored values will differ — Action: re-sync the VulnCheck connector to refresh these dates. |
| 3.0.1 | Improvements - CVE records now include the CVSS v3 temporal score. - CWE records now include a status value. - Dell advisories now include associated CVE identifiers. - GitHub advisories now include affected products. - Oracle advisories now include the publishing vendor. | N/A |
| 3.0.0 | Overview The VulnCheck connector integrates with the VulnCheck threat-intelligence platform to synchronize vulnerability, exploit, and security-advisory intelligence into Brinqa. It ingests VulnCheck's data exports — including enriched CVE records, CWE weaknesses, CPE records, end-of-life advisories, MITRE ATT&CK techniques, and security advisories from more than twenty vendors. Category: Threat Intelligence Models | N/A |