Reduce the API calls to OpenVuln API server

[jeffertz]

Hello all,

I have a bit of a dilema. I am trying to build a DB of PSIRTS from OpenVuln API that I run every so often to check for updates. Its pulling every version of software for a product using API:

example:
https://apix.cisco.com/security/advisories/v2/OSType/iosxe?version=17.2.1

And so on with all the other versions. Is there a way that I can only GET back advisories for the software based on what have been updated since X date/time?

I was thinking a &lastUpdated=<date> might work but it seems to pull back the same data as ?version=17.2.1 regardless.
Is there any light API call for these that I can check the metadata on time so I dont have to do a full API call for each software to see if any of them have been updated?

The reason I use https://apix.cisco.com/security/advisories/v2/OSType/iosxe?version=17.2.1 is because none of the other API calls seem to include the "firstFixed" and "iosrelease" in the API response body. We use these fields for checking inventory files.

Any thought on how I can do incremental updates to our DB would be appreciated instead of hammering the API server with calls that could be unwarrented?

[bigevilbeard · Accepted solution]

If you do not get a reply on this here you might want to reach out to the team for a feature request https://apiconsole.cisco.com/page/read/Support there is a separate contact for internal cisco teams too.

In my limited knowledge, i think you can use the firstPublished and lastUpdated parameters tho. https://developer.cisco.com/docs/psirt/allfirstpublished/ and https://developer.cisco.com/docs/psirt/alllastpublished/ as there does not seem to be a metadata endpoint that provides only the update timestamps without the full advisory details. 

[jeffertz]

Thanks,

Yeah problem with (all) is you get technologies that are not part of the main (supported products) like the nxos/iso/iosxe/ftd etc...

So I would have to do alot of processing to filter out the supported vs other tech psirts.

I have readed out to the support mailer for assistance. Thanks for the reply.