This document describes the CVE and CVSS enrichment capabilities integrated into the asy1um adaptive honeypot system. The integration enables automatic detection, enrichment, and adaptive response to CVE-related threats detected in honeypot logs.
ai/api/cve_enrichment.py)
ai/api/main.py)
/cveinfo - Retrieve CVE details by ID/cve/detect - Extract CVE IDs from text/cve/enrich - Enrich log entries with CVE datamonitoring/elk/logstash/pipeline/logstash.conf)
orchestration/api/server.js)
The system automatically detects CVE identifiers in honeypot logs using the pattern:
\bCVE-\d{4}-\d+\b
Detection occurs in multiple log fields:
messageinputcommanddatapayloadWhen a CVE is detected, the system queries the NVD API to retrieve:
To avoid rate limiting and reduce API calls:
Cache location: ai/data/cve_cache.json
The system responds dynamically based on CVSS severity:
Enriched log entries include new fields:
{
"cve_detected": true,
"cve_ids": ["CVE-2021-44228"],
"max_cvss_score": 10.0,
"cve_severity": "CRITICAL",
"cve_enrichments": [
{
"cve_id": "CVE-2021-44228",
"cvss_base_score": 10.0,
"cvss_severity": "CRITICAL",
"cvss_version": "3.1",
"cve_description": "Apache Log4j2 ...",
"enrichment_status": "success"
}
]
}
Retrieve detailed information about a specific CVE or multiple CVEs.
Parameters:
cve (query string): CVE identifier (e.g., CVE-2021-44228) or comma-separated list (e.g., CVE-2021-44228,CVE-2020-1234)Example (Single CVE):
curl "http://localhost:8000/cveinfo?cve=CVE-2021-44228"
Response (Single CVE):
{
"cve_id": "CVE-2021-44228",
"cvss_base_score": 10.0,
"cvss_severity": "CRITICAL",
"cvss_version": "3.1",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"cve_description": "Apache Log4j2 2.0-beta9 through 2.15.0...",
"published_date": "2021-12-10T10:15:09.000",
"enrichment_timestamp": "2024-01-15T10:30:00.000000",
"enrichment_status": "success"
}
Example (Multiple CVEs):
curl "http://localhost:8000/cveinfo?cve=CVE-2021-44228,CVE-2020-1234"
Response (Multiple CVEs):
{
"cves": [
{
"cve_id": "CVE-2021-44228",
"cvss_base_score": 10.0,
"cvss_severity": "CRITICAL",
"enrichment_status": "success"
},
{
"cve_id": "CVE-2020-1234",
"cvss_base_score": 7.5,
"cvss_severity": "HIGH",
"enrichment_status": "success"
}
],
"count": 2
}
Extract CVE identifiers from text.
Request Body:
{
"text": "Exploit attempt using CVE-2021-44228"
}
Response:
{
"cve_ids": ["CVE-2021-44228"],
"count": 1,
"timestamp": "2024-01-15T10:30:00.000000"
}
Enrich a log entry with CVE data.
Request Body:
{
"log_entry": {
"message": "Command executed: exploit CVE-2021-44228",
"cve_ids": ["CVE-2021-44228"],
"timestamp": "2024-01-15T10:30:00.000Z",
"src_ip": "192.168.1.100",
"eventid": "cowrie.command.input"
}
}
Note: The Logstash pipeline automatically sends a structured JSON payload with the following fields:
message: Original log messagecve_ids: Array of detected CVE identifierstimestamp: Event timestampsrc_ip: Source IP addresseventid: Event identifier from honeypotResponse:
{
"message": "Command executed: exploit CVE-2021-44228",
"cve_ids": ["CVE-2021-44228"],
"src_ip": "192.168.1.100",
"cve_detected": true,
"max_cvss_score": 10.0,
"cve_severity": "CRITICAL",
"cve_enrichments": [...]
}
Proxy endpoint for CVE information via the orchestration API.
Example:
curl "http://localhost:3001/cve/CVE-2021-44228"
# Query single CVE information
curl "http://localhost:8000/cveinfo?cve=CVE-2021-44228" | jq .
# Query multiple CVEs (comma-separated)
curl "http://localhost:8000/cveinfo?cve=CVE-2021-44228,CVE-2020-1234,CVE-2019-5678" | jq .
# Via orchestration API
curl "http://localhost:3001/cve/CVE-2021-44228" | jq .
curl -X POST http://localhost:8000/cve/detect \
-H "Content-Type: application/json" \
-d '{"text": "Attempting CVE-2021-44228 and CVE-2020-1234"}' \
| jq .
curl -X POST http://localhost:8000/cve/enrich \
-H "Content-Type: application/json" \
-d '{
"log_entry": {
"message": "Exploit CVE-2021-44228",
"cve_ids": ["CVE-2021-44228"],
"src_ip": "192.168.1.100"
}
}' \
| jq .
curl -X POST http://localhost:3001/events \
-H "Content-Type: application/json" \
-d '{
"type": "cve_detected",
"source": "manual",
"data": {
"cve_ids": ["CVE-2021-44228"],
"anomaly_score": 50
}
}' | jq .
Add to .env file:
# NVD API Configuration (optional - uses public endpoint by default)
NVD_API_KEY=your-api-key-here # Increases rate limit to 50 req/30s
# Cache Configuration
CVE_CACHE_EXPIRY_DAYS=7
CVE_CACHE_PATH=/app/data/cve_cache.json
Request an API key at: https://nvd.nist.gov/developers/request-an-api-key
The system includes robust failure handling:
enrichment_status: "timeout"enrichment_status: "not_found"enrichment_status: "parse_error"{
"cve_id": "CVE-2021-44228",
"enrichment_status": "failed",
"error": "NVD API timeout"
}
The orchestration API exposes Prometheus metrics:
# Count of CVE detection events
orchestration_events_total{type="cve_detected"}
# Event processing duration
event_processing_duration_seconds{event_type="cve_detected"}
Search for CVE-related events:
# All CVE detections
cve_detected:true
# Critical CVEs only
cve_severity:CRITICAL
# High CVSS scores
max_cvss_score:>=9.0
# Specific CVE
cve_ids:"CVE-2021-44228"
Run the CVE enrichment test suite:
cd ai
python -m pytest tests/test_cve_enrichment.py -v
python -m pytest tests/test_cve_api.py -v
Test coverage:
Problem: CVE query returns “not found”
Solutions:
CVE-YYYY-NNNNProblem: Receiving 403 errors from NVD API
Solutions:
Problem: Cache not persisting between restarts
Solutions:
ai/data/cve_cache.jsonProblem: CVE enrichment taking too long
Solutions:
NVD_REQUEST_TIMEOUT settingPotential improvements for the CVE integration:
For issues or questions:
docs/ directory