About CERTCC/SSVC

[JetsettersSC]

I was wondering if I could use CERTCC/SSVC２(https://democert.org/ssvc/) for the company I work. However, importing CVE does not seem to work. Can you tell me how I should use it?
Also, I am interested in the fact that when I select a sample CVE, it automatically generates a tree flow to show me what I have to deal with. How does it work?

[sei-vsarvepalli]

Hello @JetsettersSC

Have you looked at the example Tab delimited TSV file in the Demo site? It may give you an idea of how to formulate your TSV file or CSV file so it can be processed by the program.

https://democert.org/ssvc/sample-ssvc.txt

If you have a sample CSV file, attach it to the Case and I can try to verify if it works or needs some adjustments.

Thanks
Vijay

[JetsettersSC]

Thank you for your reply.
I would like to have the ability to automatically determine each step of the SSVC process or information to assist me. Is it correct to say that I need to fill in the information for other items( other than CVE-2020-7961 for example) to suit my environment, and then import it into this tool?

https://democert.org/ssvc/sample-ssvc.txt

CVE-2020-7961 Liferay Portal JSON web services (JSONWS) deserialization 9.8 Track PoC Yes Total Low (Minimal/Minimal)

[sei-vsarvepalli]

Hello @JetsettersSC

Were you able to use a text file with your example and get it imported to the tool okay?

As far as where to find SSVC metrics of vulnerabilities:
Currently we don't have a central place like NIST where analysis of various SSVC metrics can be available. As we get closer to a larger audience using it, we are hoping some way to help operationalize such a place. As far as automation, we are looking at using many feeds such as Exploit feeds and our own project https://github.com/CERTCC/labyrinth to try to collect information on vulnerabilities that can be automated to get parts of SSVC tree values (like Exploitation), be maintained and updated.

I am happy to connect you to other organizations that are attempting to adopt SSVC, perhaps that will help.

Vijay