Patrick Garrity 👾🛹💙’s Post

Patrick Garrity 👾🛹💙

Cybersecurity/Vulnerability Researcher

6mo Edited

Thanks for the community support over the past few weeks as we've rolled out VulnCheck CPE enrichment! To provide a better understanding of how VulnCheck CPE enrichment works, I've put together this quick video which includes: 1. Our approach to generating and delivering CPE data: - Automated CPE Generation - High-Quality CPE - Reliable & Machine Readable - Available as a Community Resource delivered at no cost 2. A walkthrough on how to get access to VulnCheck CPE enrichment data, designed to maintain the integrity of the National Institute of Standards and Technology (NIST) NVD. You can gain immediate access here: https://lnkd.in/g_7yyQKH Jay Wallace Tony Wenzel Jacob Baines Anthony Bettini Ralph Logan Clint Merrill Thomas Bain #cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement

3 Comments

Transcript

Hello, I'm Patrick Garrity, security researcher here at Phone Check. And today I'm going to dive into Vulncheck's Common Platform Enumeration Enrichment capabilities, also known as CPE. At Von Check, we've been diligent in our commitment to working to deliver automated, accurate and reliable CPE generation and our objectives are very clear. Number one, we're focused on automating CPE generation and this ensures more timely. Access to the information needed so you can correlate products to vulnerabilities even when the NVD returns. Next, we're focused on accuracy, so we're using automated capabilities to do CPR validation to maintain high quality CPE. Then we're focused on delivering the CPE enrichment as a reliable service. And not only CPE, but the complete NVD list and delivered at machine speeds facilitating quick and reliable access to. Anyone. And we're committed to doing this as a community resource, which means we're providing our CPE enrichment service free of charge to the community, ensuring accessibility to all. Our CPE enrichment is available in both our community edition of our product known as NVD and our commercial service known as VulnCheck NVD. Let's do a quick walk through on how to get access to VulnCheck. CPE Enrichment. First off, you'll need to get access to your VulnCheck Account. If you don't have one, you can sign up for a free community account from our home page in the top right hand corner and then you can access the dashboard. All that we ask is an e-mail address in order to be able to register and gain access. From here you can access the CPE data from the VulnCheck APIs. So there's really a few different options. First I want to highlight if we hop over to the API sandbox. There's a few different APIs, the default one being VulnCheck KEV which is our Known Exploited Vulnerabilities Catalog and then we see NIST NVD 2 and NIST NVD. If you're a commercial customer, you'll have many many many more options as far as indexes, and you might want to consider getting VulnCheck NVD 2 or VulnCheck-NVD. For this purpose we're going to use the NIST NVD 2 which is the latest JSON version that. They provide and you can see here we can quickly download a full backup of the NVD. So we're now just delivering CPE information here. It's the full copy or you can access it via API. So we see the API strings here, the index, which I'm going to show you, we can copy this and then we can hop over and I have an example CVE. 2024-28746 which is a CVE that we'll see does not have have CPE data. What you will see here is uh vcConfiguration. So this is VulnCheck configurations. We see a CPE match here with the criteria. And then you can see the unrolling of the CPE and VC vulnerable CPE. So pretty simple you can send an individual query. This way if you want to generate a key you can do it programmatically as well. And then the last thing I want to highlight, if we hop over to the docs.volcheck.com under community we have NVD++ and we can see here we have a section for VulnCheck CPE schema. So we maintain the. Integrity of the original CPE and then we enrich it with this VC configurations and this is the same example as we showed before. We have the CPE match and then we have the VC vulnerable Cpes. And this concludes how you can get quick access to VulnCheck CPE enrichment. And other enrichment capabilities in the future through our VulnCheck NVD++ Community Edition and also our commercial offering of VulnCheck-NVD. Thanks and have a great day.

Mauricio Ortiz, CISA

Mauricio Ortiz, CISA

Great dad | Inspired Risk Management and Security Profesional | Cybersecurity | Leveraging Data Science & Analytics My posts and comments are my personal views and perspectives but not those of my employer

6mo

VulnCheck the new NVD 👏... maybe National Institute of Standards and Technology (NIST) can learn a thing or two about how do enrichment more effectively.

To view or add a comment, sign in

More Relevant Posts

Thomas Bain

Chief Marketing Officer, VulnCheck. Experienced B2B Marketing Leader in Cybersecurity. Investor and advisor to early-stage, B2B cyber and AI startup's. 2024 RSAC Innovation Sandbox finalist/presenter. Taekwondo athlete.
6mo
Report this post
Take a listen to Patrick Garrity 👾🛹💙's latest video that will give anyone a boiled-down, easy to consume and easy to follow video for how to access our Community tier offerings that are now shipping with enriched CPE data. Check it out. Become a Community user to get a flavor for VulnCheck's enterprise solutions! #vulncheck #exploitintelligence #cpe

Patrick Garrity 👾🛹💙

Cybersecurity/Vulnerability Researcher
6mo Edited

Thanks for the community support over the past few weeks as we've rolled out VulnCheck CPE enrichment! To provide a better understanding of how VulnCheck CPE enrichment works, I've put together this quick video which includes: 1. Our approach to generating and delivering CPE data: - Automated CPE Generation - High-Quality CPE - Reliable & Machine Readable - Available as a Community Resource delivered at no cost 2. A walkthrough on how to get access to VulnCheck CPE enrichment data, designed to maintain the integrity of the National Institute of Standards and Technology (NIST) NVD. You can gain immediate access here: https://lnkd.in/g_7yyQKH Jay Wallace Tony Wenzel Jacob Baines Anthony Bettini Ralph Logan Clint Merrill Thomas Bain #cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement
Like Comment
To view or add a comment, sign in
Cyentia Institute

3,407 followers
5mo Edited
Report this post
Jay Jacobs & Ben Edwards join us for a look into the Exploit Prediction Scoring System. In this talk, we'll share a bit about the new EPSS updates, discuss the increasing data and partnerships, how we use EPSS and how you can benefit from the Exploit Prediction Scoring System. Get an inside look into the open, data-driven effort for estimating the likelihood that a software vulnerability will be exploited in the wild with Ben & Jay! https://lnkd.in/epyZGK6q #Webinar #infosecurity #cybersecurity #riskmanagement #exploits #EPSS
Like Comment
To view or add a comment, sign in
Ariginaltech

104 followers
4mo
Report this post
Did you know 76% of mid-sized organizations have experienced data loss in the last five years? The impact can be devastating, leading to lost client information and damaged reputations. But there’s good news! With Ariginaltech, you can safeguard your organization’s valuable information. Don’t wait – contact us to learn more: https://lnkd.in/gYSThVaH #DataProtection #DataSecurity #BusinessContinuity #CyberSecurity #AriginalTech #ProtectYourData #SecureYourBusiness #InfoSec

1 Comment
Like Comment
To view or add a comment, sign in
Patrick Garrity 👾🛹💙

Cybersecurity/Vulnerability Researcher
6mo Edited
Report this post
Three weeks ago, we introduced VulnCheck CPE enrichment to support the security community while the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) has experienced a continued delay in processing new CVEs. Currently we provide 100% CPE coverage of 46 CVE Numbering Authorities (CNAs) and generate CPE for 117 out of 181 CNAs. In order to help provide better clarity on our current coverage, I put together a Sankey diagram. Full details on VulnCheck CPE coverage and details on how to use vcCPE through NVD++ are available here: https://lnkd.in/gAZSQn-t Thomas Bain Jay Wallace Tony Wenzel Clint Merrill Jacob Baines Anthony Bettini #cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement
9 Comments
Like Comment
To view or add a comment, sign in
SMBWISE

9 followers
9mo
Report this post
Don't play the data loss gamble! ⁠ ⁠ At SMBWISE, we understand the value of your digital assets. Regular backups aren't just a suggestion—they're your safety net against unexpected data disasters. 💻⁠ ⁠ 🔒 Secure your peace of mind: Back up your files regularly to ensure your important data is always safe and sound. With our expertise, we'll guide you through seamless backup solutions, protecting your valuable information from any digital mishaps.⁠ ⁠ 🔁 Don't wait for a tech emergency to strike! Contact us today to safeguard your digital treasure trove.⁠ #techie #tipoftheday #backupfiles #supportsmallbusiness #technology #cybersecurity #didyoukow #techtip #digitalassets #businessownser #growyourbiz #growthstrategy #organizemybusiness #smallbiztips #smallbusinesstips #businessgrowthstrategy #growyourbusiness #businessgrowth #businessleaders #businessownerlife #ceomindset
Like Comment
To view or add a comment, sign in
IT Ninjas

282 followers
8mo
Report this post
Happy Safer Internet Day from IT Ninjas! Today, we celebrate #SaferInternetDay by reaffirming our commitment to safeguarding your digital world. As your trusted MSP in Jacksonville, FL, we prioritize education and awareness for creating safer internet habits. From proactive threat detection to robust data encryption, we've got you covered. Let's work together to build a safer digital environment for all! 🛡️ #CyberSecurity #ManagedServices #JacksonvilleFL #OnlineSafety"
Like Comment
To view or add a comment, sign in
Chris Bacon

Helping organisations reduce vulnerability and improve visibility
4mo
Report this post
With MFA being a security fundamental, it's important to get it right so that security doesn't impact productivity. A great article that could save you hours of frustration and troubleshooting and improving user experience.
Ewelina Paczkowska

Microsoft Security Consultant | Microsoft 365 Security & Compliance User Group Co-organiser
4mo

🚨 New Blog Post Alert! 🚨 Are you experiencing Multi-Factor Authentication (MFA) fatigue? 😫 If you're repeatedly prompted to reauthenticate every time you open a new tab, navigate to a different portal, or access a blade, then this post is for you! In my latest blog post, I dive into the common causes of MFA fatigue and share a detailed solution that could save you hours of frustration and troubleshooting when you come across sign-in error code 9002341: User is required to permit SSO. Join the conversation and let me know if you've been dealing with similar issues. 👉 https://lnkd.in/eCCmatmW #TechTips #CyberSecurity #MFA #SignInFailure #WindowsSingleSignOn #WindowsSSO #DigitalMarketsAct #DMA #Reauthentication
Like Comment
To view or add a comment, sign in
Empowerment through Technology & Education, Inc.

597 followers
5mo
Report this post
Secure your business's future with ETTE's data backup solutions! 🔒 Our service provides reliable protection against data loss from cyberattacks or system malfunctions, ensuring your business's operational continuity. With adaptable options of full, incremental, or differential backups, we cater to your company's unique needs. Invest in affordable peace of mind knowing your essential information is safeguarded with ETTE. #DataBackup #CyberSecurity #ETTE #BusinessContinuity #DataProtection #AffordableSolutions #SecureYourFuture
Like Comment
To view or add a comment, sign in
Steve Makousky

CISSP, CCSP
6mo
Report this post
solid solution, check this out if you have not already done so!
Kevin Arsenault

Chief Revenue Officer (CRO) | GTM Advisor
6mo

⏳ **Our team will be at #RSAC. DM me if you are interested in learning about how Ordr Inc. can help with understanding your firm's attack surface, including: - Providing a comprehensive and accurate view of all managed and unmanaged devices on your network - Enabling your security team to move rapidly through the preparation stage of Incident Response - Helping your team get a handle on agent health - Prioritizing and improving your vulnerability context I look forward to reconnecting with friends and colleagues! #RSAC #cybersecurity #RSA2024 🎉 Also, Don’t miss our Party, co-hosted with Synack, Inc. & RedSeal, Inc., on Tuesday, May 7th! RSVP here: https://bit.ly/49pUUns
Like Comment
To view or add a comment, sign in
Rootshell Security

1,579 followers
6mo
Report this post
This is your reminder to register for our webinar with Rootshell's esteemed Head Phisherman, Andrew Stanistreet. 🔍 Social engineering attacks are cunning, crafted to slip under the radar, often leaving individuals and organisations vulnerable without their knowledge. As the Head of Social Engineering and Network Infrastructure Services, Andrew brings a wealth of knowledge and experience to the table. In this webinar, he will peel back the layers of social engineering. 📆 Mark your calendars and register here - https://ow.ly/hexK50R9nbk Looking forward to seeing you there! #CyberSecurity #SocialEngineering #Webinar #InformationSecurity
1 Comment
Like Comment
To view or add a comment, sign in

Patrick Garrity 👾🛹💙

30,822 followers

View Profile Follow

More from this author

Explore topics

翻译：