Turning a CVE into a vulnerability advisory with zsazsa and Flowintel

In the previous post we used zsazsa to build a daily threat briefing from the material you already collect in MISP. We stay with the same approach, creating products from the information you have, but this time we focus on one of the most routine jobs for a CTI team: turning a CVE into a vulnerability advisory.

A vulnerability advisory tells a specific audience about a vulnerability: what it is, which products and versions are affected, how serious it is, and what the reader is expected to do about it. It is the difference between “there is a new Cisco CVE” and “here is the Cisco CVE that matters to us, and here is what the vulnerability management team needs to do this week”.

This is exactly the kind of work zsazsa is built for. Events that mention a CVE come in from MISP communities and from the MISP scraper, and you flag the ones worth acting on. In this post we walk through the steps: we pick up an event from the daily collection, turn it into a vulnerability advisory, enrich it, and forward it to Flowintel for further processing.

The videos use the UiBeta theme for a better visual integration with MISP.

Create a stakeholder

First we create our stakeholder, in this case the vulnerability management team, which takes on the stakeholder role of … “vulnerability management”. We then subscribe them to the vulnerability advisory product and give them two notification channels: a Mattermost channel and Flowintel as the case management system.

Afterwards, we also review where exactly there are situated in the power/interest matrix.

Select the vulnerability

Next we go to data collection. One of the presets filters for events that refer to a CVE. You do this via the property “Covers a CVE”, which matches on CVE identifiers in the event or on events that contain a vulnerability attribute.

We select an event about a Cisco vulnerability. This one also touches one of our PIRs, the one that says we want to know about anything happening around Cisco.

From there zsazsa does the heavy lifting. It takes the CVE from the original event and enriches it through vulnerability lookup, and a small AI query adds extra context. The affected products and versions, the CVSS score and the CWE are filled in for us, along with a flag that the vulnerability is being actively exploited and is on the KEV list. It then drafts the summary and the recommended actions, so your job is to check and improve the text rather than write it from scratch.

For our own team we add the activity we expect them to carry out when they receive the advisory. We set the TLP level and the target audience, in this case the vulnerability management team and our SOC.

Review and publish

Once the advisory is written, it is kept in draft. The idea is that someone else on the team reviews it for completeness before it goes out. If they are happy with the content they can, if needed, check exactly who will receive it using the “Recipients” button. This gives a clear overview of who the product will reach. The review step is also where they can add their own feedback. Next to that, we can also have a preview on an eventual PDF versoin.

Afterwards, they can publish it.

Notification to Flowintel

Flowintel is an open-source case management platform. Its REST API let you fit Flowintel into the tooling you already run, rather than replacing what is already there. It is exactly that REST API we use to integrate Flowintel with zsazsa.

Before any of this works, we set Flowintel up as one of the notification channels and then configure it use a specific case template and task for vulnerability advisories.

When the advisory is published, it is disseminated to the relevant stakeholders through their preferred channel. For the vulnerability management team, this is Flowintel.

A new case is created from one of the Flowintel templates available for integration with Flowintel. Templates help ensure consistency in case handling, so the team follows a prescribed way of working. In this integration, we use the Vulnerability Exploitation template, together with a number of steps the team needs to complete.

To make this easier, the integration with Flowintel already adds the full advisory details to the case notes. Flowintel also supports MISP objects, including the vulnerability object. In Flowintel, we attach this vulnerability object to the case, link it to one of the case tasks, and assign one of our handlers to follow up. We also create a case report in PDF and attach it to the case. This serves as a snapshot of the current status of the case.

And of course the usual notification still goes out over Mattermost.

It is all in MISP

It is worth remembering that in zsazsa, every product and every piece of information is stored in MISP. This has a useful consequence: Mattermost and Flowintel are not the only ways to distribute a product. You can also use MISP’s own distribution model to share the advisory, including any comments added to it, with your MISP communities. The advisory is a MISP event like any other, so the sharing groups and distribution levels you already use apply without any extra work.

For the people receiving the advisory, this is more useful than it may first appear. Because the advisory is a normal MISP event, your communities receive it through the synchronisation they already have in place. They get the vulnerability object, can correlate the CVE against their own data, and can feed the information directly into the tooling connected to their MISP instance.

That is what makes this approach practical. The advisory stays inside the “environment” you already use. It starts as an event in your MISP, is enriched and written in zsazsa, reviewed and published there, and then ends up as a case in Flowintel, a message in Mattermost and, if you choose, a shared event in your MISP communities. There is no separate vulnerability tracker to keep in sync, and no awkward export step between collection and action. It is the same MISP instance throughout, simply doing more of the work you were already asking it to do.