-
Notifications
You must be signed in to change notification settings - Fork 1
Description
I apologize for what is almost certainly going to be read as a dumb question, but we have a use case in which we want to be able to search AVID vulnerability entries via free text search to find vulnerabilities that are most similar to what we are seeing in our system. The goal is to associate one or more vulnerabilities (and thus hopefully also mitigations the community has identified - are these tracked in AVID?) to the system events we're seeing that the vulnerabilities map to. However, I can't figure out how to get a list of all the current AVID vulnerabilities tracked let alone do this kind of free text search.
So my question is ultimately three-fold:
- What is the basic pattern to get a listing of vulnerabilities (e.g. a RESTful endpoint I could ping with python
requests)? - Do vulnerabilities track mitigations as well?
- Is there a way to do free text search or some other search functionality of vulnerabilities in the database without knowing their ID in advance?
- Bonus question: is there a way to see the dates/datetimes when a vulnerability was first submitted/started being tracked by AVID?
Thanks for any help you can provide! I'd be happy to submit a PR to the docs after I square all of this away.