Find Affected Assets

Description

This tool can be used to find Affected Assets on Vulnerabilities using a provided filter expression.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool find_affected_assets and click Add

Example Prompts

How many affected assets do I have? Include custom fields in the response.

Supported Query Fields

ids: {
  description: 'Find AttackForge affected assets by id.',
  type: 'array',
  items: {
    type: 'string',
    pattern: '^[0-9a-fA-F]{24}$'
  }
}

Example Response

{
    "data":
    [
        {
            "id": "64e17a99009140000f4acf70",
            "name": "192.168.0.1",
            "components":
            [
                {
                    "name": "192.168.0.1",
                    "notes":
                    [
                        "\nThe following is a list of SSL anonymous ciphers supported by the remote server :\n\n  Medium Strength Ciphers (> 64-bit and < 112-bit key, or 3DES)\n\n    ADH-DES-CBC3-SHA             Kx=DH          Au=None     Enc=3DES-CBC(168)        Mac=SHA1   \n    AECDH-DES-CBC3-SHA           Kx=ECDH        Au=None     Enc=3DES-CBC(168)        Mac=SHA1   \n\n  High Strength Ciphers (>= 112-bit key)\n\n    DH-AES128-SHA256             Kx=DH          Au=None     Enc=AES-GCM(128)         Mac=SHA256  \n    DH-AES256-SHA384             Kx=DH          Au=None     Enc=AES-GCM(256)         Mac=SHA384  \n    ADH-AES128-SHA               Kx=DH          Au=None     Enc=AES-CBC(128)         Mac=SHA1   \n    ADH-AES256-SHA               Kx=DH          Au=None     Enc=AES-CBC(256)         Mac=SHA1   \n    ADH-CAMELLIA128-SHA          Kx=DH          Au=None     Enc=Camellia-CBC(128)    Mac=SHA1   \n    ADH-CAMELLIA256-SHA          Kx=DH          Au=None     Enc=Camellia-CBC(256)    Mac=SHA1   \n    AECDH-AES128-SHA             Kx=ECDH        Au=None     Enc=AES-CBC(128)         Mac=SHA1   \n    AECDH-AES256-SHA             Kx=ECDH        Au=None     Enc=AES-CBC(256)         Mac=SHA1   \n    DH-AES128-SHA256             Kx=DH          Au=None     Enc=AES-CBC(128)         Mac=SHA256  \n    DH-AES256-SHA256             Kx=DH          Au=None     Enc=AES-CBC(256)         Mac=SHA256  \n\nThe fields above are :\n\n  {OpenSSL ciphername}\n  Kx={key exchange}\n  Au={authentication}\n  Enc={symmetric encryption method}\n  Mac={message authentication code}\n  {export flag}\n",
                        "http://www.nessus.org/u?3a040ada"
                    ],
                    "tags":
                    [
                        "port:21",
                        "pluginID:31705",
                        "pluginFamily:Service detection",
                        "svc_name:ftp",
                        "protocol:tcp",
                        "severity:1",
                        "cve:CVE-2007-1858",
                        "cvss3_base_score:5.9",
                        "cvss3_temporal_score:5.2",
                        "cvss3_temporal_vector:CVSS:3.0/E:U/RL:O/RC:C",
                        "cvss3_vector:CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                        "cvss_base_score:2.6",
                        "cvss_temporal_score:1.9",
                        "cvss_temporal_vector:CVSS2#E:U/RL:OF/RC:C",
                        "cvss_vector:CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N",
                        "exploit_available:false",
                        "exploitability_ease:No known exploits are available",
                        "plugin_modification_date:2018/08/03",
                        "plugin_publication_date:2008/03/28",
                        "plugin_type:remote"
                    ]
                }
            ],
            "notes":
            [],
            "tags":
            [],
            "actioned": false,
            "asset_type": "Infrastructure",
            "external_asset_id": "CMDB-123",
            "details": "This asset is the main router for the head office",
            "custom_fields":
            [
                {
                    "key": "af_sys_hostnames",
                    "value":
                    [],
                    "label": "Hostnames"
                },
                {
                    "key": "internet_facing",
                    "value": "Yes",
                    "label": "Internet Facing"
                },
                {
                    "key": "subnets",
                    "value":
                    [
                        "192.168.0.0/24",
                        "192.168.0.1/24"
                    ],
                    "label": "Subnets"
                },
                {
                    "key": "af_sys_ports",
                    "value":
                    [],
                    "label": "Ports"
                }
            ],
            "vulnerability_id": "64e17a99009140000f4acf6e"
        }
    ],
    "count": 1,
    "total": 1
}