on - edited on by
Katie Kolon
When the time comes to make a bulk change to your data in Cisco Vulnerability Management using an API or automated script is usually the ideal approach. Maybe you need to mark all findings of a certain CVE as Risk Accepted, or change the assigned owner of a thousand assets.
Cisco Vulnerability Management has a number of API endpoints to use for performing bulk updates:
- https://apidocs.kennasecurity.com/reference/bulk-update-assets
- https://apidocs.kennasecurity.com/reference/bulk-update-vulnerability
- https://apidocs.kennasecurity.com/reference/update-permissions-in-bulk
- https://apidocs.kennasecurity.com/reference/bulk-delete-findings
But even if you don't know a POST request from a PuTTY client, Cisco Vulnerability Management allows you to easily make large bulk updates without busting out a coding textbook.
Let's walk through an example together. Let's assume that CVE-2017-3167 needs to have a static due date applied outside of the due date dynamically assigned by your SLA rules. In this example CVE-2017-3167 needs to be fixed on each vulnerable asset by 4/17/2021.
After performing the query "cve:2017-3167" we have a list of 7,032 vulnerabilities which need to be updated.
Even if the maximum of 100 vulnerabilities per page is displayed, that's still over 70 pages of vulnerabilities to go through! Let's click on the "Apply to all vulnerabilities matching this criteria" link to select all 7,032 vulnerabilities at once.
Now if we click the edit button and set the due date to 4/17/21 then that change will apply to all 7,032 vulnerabilities as a single update.
BONUS: If you're making a really large bulk update, you can use the Alerts feature to receive a notification once the bulk update is complete. Sure beats refreshing your browser until the work is complete!
