mchaiwimol
11/29/2017 - 8:34 PM

Transform Temporal Metric from Qualys to ServiceNow

Baseline integration doesn't update the temporal metrics into ServiceNow. Add a transform script to process an additional script to update the metrics.

var QualysKnowledgeTransformUtilCustom = Class.create();
QualysKnowledgeTransformUtilCustom.prototype = {
    initialize: function() {
        this._util = new sn_vul.VulnerabilityTransformMapUtil();
    },

    //Convert XML to Object
    _getXmlDoc: function(xmlText) {
        if (xmlText != null && xmlText != "") {
            var xmlDoc = new XMLDocument2();
            xmlDoc.parseXML(xmlText);
            return xmlDoc;
        }
        return null;
    },

    // Maps the temporal metrics to third party vulnerabilities library
    processCVSS: function(source, target) {
        var cvssXml = this._getXmlDoc(source.u_cvss);
        if (cvssXml == null) return;
        var node = cvssXml.getFirstNode("/CVSS");
        if (node == null) {
            return;
        }

        var cvss = this._util.safeXmlElementToObject(node.toString());
        if (cvss == null)
            return;

        try {
            var cvssStr = "CVSS2#";
            cvssStr += "E:" + this._cvssValueMap["E"][cvss.CVSS.EXPLOITABILITY] + "/";
            cvssStr += "RL:" + this._cvssValueMap["RL"][cvss.CVSS.REMEDIATION_LEVEL] + "/";
            cvssStr += "RC:" + this._cvssValueMap["RC"][cvss.CVSS.REPORT_CONFIDENCE] + "/";
            var fieldMap = this._util.parseCVSS(cvssStr, "TEMPORAL");
            this._util._updateGlideRecordFromPropMap(target, fieldMap);
            target.update();
        } catch (e) {
            gs.warn("Caught error while processing CVSS");
            gs.warn(e);
        }
    },

    _cvssValueMap: {
        AV: {
            1: "L",
            2: "A",
            3: "N"
        },
        AC: {
            1: "L",
            2: "M",
            3: "H"
        },
        Au: {
            1: "N",
            2: "S",
            3: "M"
        },
        C: {
            1: "N",
            2: "P",
            3: "C"
        },
        I: {
            1: "N",
            2: "P",
            3: "C"
        },
        A: {
            1: "N",
            2: "P",
            3: "C"
        },
        E: {
            1: "U",
            2: "POC",
            3: "F",
            4: "H",
            0: "ND"
        },
        RL: {
            1: "OF",
            2: "TF",
            3: "W",
            4: "U",
            0: "ND"
        },
        RC: {
            1: "UC",
            2: "UR",
            3: "C",
            0: "ND"
        }
    },

    type: 'QualysKnowledgeTransformUtilCustom'
};
(function runTransformScript(source, map, log, target /*undefined onStart*/ ) {
 
  var util = new sn_vul_qualys.QualysKnowledgeTransformUtilCustom();
  util.processCVSS(source, target);
  
})(source, map, log, target);