Digital Defense FrontlineVM

This Integration is part of the Digital Defense Frontline VM Pack.

Use the Digital Defense Frontline VM to identify and evaluate the security and business risks of network devices and applications deployed as premise, cloud, or hybrid network-based implementations. This integration was integrated and tested with version 6.2.4 of Digital Defense FrontlineVM

Configure Digital Defense FrontlineVM in Cortex

Parameter	Description	Required
frontlineURL	Frontline VM URL	True
insecure	Trust any certificate (not secure)	False
apiToken	API Token to access Frontline VM	True
isFetch	Fetch incidents	False
incidentType	Incident type	False
incidentSeverity	Minimum vulnerability severity for fetching incidents	False
incidentFrequency	Rate at which to check vulnerability events when fetching incidents	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

frontline-get-assets

---

Retrieves the asset's information from Frontline VM.

Base Command

frontline-get-assets

Input

Argument Name	Description	Required
ip_address	The IP address for which to return assets.	Optional
label_name	The label name for which to return assets.	Optional
max_days_since_scan	The number of days (retroactive) since the last scan.	Optional
hostname	The hostname for which to return assets.	Optional

Context Output

Path	Type	Description
FrontlineVM.Hosts	unknown	The host data from Frontline.Cloud.
FrontlineVM.Hosts.ID	unknown	The ID number of the host.
FrontlineVM.Hosts.Hostname	unknown	The hostname of the asset.
FrontlineVM.Hosts.IP	unknown	The IP address of the host.
FrontlineVM.Hosts.DNSHostname	unknown	The DNS hostname of the host.
FrontlineVM.Hosts.MAC	unknown	The MAC address of the host.
FrontlineVM.Hosts.OS	unknown	The operating system of the host.
FrontlineVM.Hosts.OSType	unknown	The operating system type of the host.
FrontlineVM.Hosts.CriticalVulnCount	unknown	The severity count of critical vulnerabilities.

Command Example

#### Human Readable Output

### frontline-get-vulns

***

Retrieves vulnerability information from Frontline VM.

#### Base Command

`frontline-get-vulns`

#### Input

| **Argument Name** | **Description** | **Required** |

| --- | --- | --- |

| min_severity | The minimum severity level for which to return vulnerabilities. This argument overrides the "severity" argument when used together. Can be: "critical","high","medium","low","trivial", or "info". | Optional |

| severity | Returns all vulnerabilities from Frontline with the specified severity level. Can be: "critical","high","medium","low","trivial", or "info". | Optional |

| max_days_since_created | Retrieves vulnerabilities found prior to the specified date (in days). | Optional |

| min_days_since_created | Retrieves vulnerabilities found after the specified date (in days). | Optional |

| host_id | Retrieves vulnerabilities from a specific host based on the Host ID. | Optional |

| ip_address | The IP address of the host for which to retrieve the vulnerability data. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |

| --- | --- | --- |

| FrontlineVM.Vulns | unknown | Retrieved vulnerability data pulled from Frontline.Cloud. |

| FrontlineVM.Stat | unknown | The statistical overview of vulnerabilities pulled. |

| FrontlineVM.Vulns.vuln-id | unknown | The ID of the vulnerability. |

| FrontlineVM.Vulns.hostname | unknown | The hostname of the asset. |

| FrontlineVM.Vulns.ip-address | unknown | The IP address of the asset. |

| FrontlineVM.Vulns.vuln-title | unknown | The title of the vulnerability. |

| FrontlineVM.Vulns.date-created | unknown | The date the vulnerability was created. |

| FrontlineVM.Vulns.ddi-severity | unknown | The severity level of the vulnerability. |

| FrontlineVM.Vulns.vuln-info | unknown | Information related to the vulnerability. |

#### Command Example

Human Readable Output

frontline-scan-asset

---

Performs a scan on the specified asset.

Base Command

frontline-scan-asset

Input

Argument Name	Description	Required
ip_address	The IP address of the asset to scan.	Optional
scan_policy	The policy of the scan (case sensitive).	Optional
ip_range_start	The IP address start range of the asset to scan.	Optional
ip_range_end	The IP address end range of the asset to scan.	Optional
scan_name	The name of this scan to run in FrontlineVM. Default value will be "Cortex XSOAR Scan [<asset_ip_address>]"	Optional

Context Output

Path	Type	Description
FrontlineVM.Scan.ID	unknown	The ID number of the scan.
FrontlineVM.Scan.Name	unknown	The name of the scan.
FrontlineVM.Scan.Policy	unknown	The policy name of the scan.
FrontlineVM.Scan.IP	unknown	The IP address of the scan (can be a single IP address or a range of IP addresses).

Command Example

#### Human Readable Output