javascript 更新环境评分
Posted
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了javascript 更新环境评分相关的知识，希望对你有一定的参考价值。
var CVSSMetricUtilsTags = Class.create();
CVSSMetricUtilsTags.prototype = {
initialize: function(vulGR) {
this._gr = vulGR;
//Base Metric - Third party
this.av = vulGR.vulnerability.access_vector;
this.ac = vulGR.vulnerability.access_complexity;
this.au = vulGR.vulnerability.authentication;
this.c = vulGR.vulnerability.confidentiality_impact;
this.i = vulGR.vulnerability.integrity_impact;
this.a = vulGR.vulnerability.availability_impact;
//Temporal Metric - Third party
this.e = vulGR.vulnerability.exploitability;
this.rl = vulGR.vulnerability.remediation_level;
this.rc = vulGR.vulnerability.report_confidence;
//Asset Group
this.groups = vulGR.cmdb_ci.sn_vul_qualys_host_tags.split(',');
},
updateEnvironmentalScore: function() {
var groupObject;
var groupScore = '';
var highestScore = 0;
var env = 0;
for (var i = 0; i < this.groups.length; i++) {
groupObject = this.getAssetGroup(this.groups[i]);
if (typeof groupObject != "object") {
if (groupScore == '') {
groupScore = groupObject + ": Group doesn't exist";
} else {
groupScore += "\n" + groupObject + ": Group doesn't exist";
}
} else {
if (this.checkEnvScoreMetricIsDefined(this.groups[i])) {
env = this.calculateEnvironmentalScore(this.groups[i]);
//Find the highest score
highestScore = env > highestScore ? env : highestScore;
//Generate score for all groups
if (groupScore == '') {
groupScore = groupObject.asset_group_name + ": " + env;
} else {
groupScore += "\n" + groupObject.asset_group_name + ": " + env;
}
} else {
if (groupScore == '') {
groupScore = groupObject.asset_group_name + ": Not Defined";
} else {
groupScore += "\n" + groupObject.asset_group_name + ": Not Defined";
}
}
}
}
//Update environmental score
this._gr.u_environmental_score_per_group_host_tags = groupScore;
this._gr.u_environmental_score_host_tags = highestScore;
this._gr.update();
},
calculateAdjustedImpact: function(group) {
//Formula: min(10,10.41*(1-(1-ConfImpact*ConfReq)*(1-IntegImpact*IntegReq)*(1-AvailImpact*AvailReq)))
var env = this.getEnvironmentalMetric(group);
var confImpact = this.getBaseMetricValue("impact", this.c);
var confReq = env.cr;
var integImpact = this.getBaseMetricValue("impact", this.i);
var integReq = env.ir;
var availImpact = this.getBaseMetricValue("impact", this.a);
var availReq = env.ar;
var adjustedImpact = 10.41 * (1 - (1 - confImpact * confReq) * (1 - integImpact * integReq) * (1 - availImpact * availReq));
adjustedImpact = this._round(adjustedImpact, 1); //Round to 1 decimal
return adjustedImpact > 10 ? 10 : adjustedImpact; // Highest score is 10
},
calculateExploitability: function() {
//Formula: Exploitability = 20 * AccessVector * AccessComplexity * Authentication
var accessVector = this.getBaseMetricValue("av", this.av);
var accessComplexity = this.getBaseMetricValue("ac", this.ac);
var authentication = this.getBaseMetricValue("au", this.au);
var exploitability = 20 * accessVector * accessComplexity * authentication;
return this._round(exploitability, 1);
},
calculateAdjustedBase: function(group) {
//Formula: round_to_1_decimal(((0.6*AdjustedImpact)+(0.4*Exploitability)-1.5)*f(Impact))
//Example: AdjustedBase =((0.6*9.6)+(0.4*10.0)-1.5)*1.176
var adjImpact = this.calculateAdjustedImpact(group);
var exp = this.calculateExploitability();
var f = adjImpact == 0 ? 0 : 1.176;
var adjustedBase = ((0.6 * adjImpact) + (0.4 * exp) - 1.5) * f;
return this._round(adjustedBase, 1);
},
calculateAdjustedTemporal: function(group) {
//Formula: TemporalScore = round_to_1_decimal(BaseScore*Exploitability*RemediationLevel*ReportConfidence)
//TemporalScore recomputed with the BaseScore's Impact sub-equation replaced with the AdjustedImpact equation
var adjBase = this.calculateAdjustedBase(group);
var exploiability = this.getTemporalMetricValue("e", this.e);
var remediationLevel = this.getTemporalMetricValue("rl", this.rl);
var reportConfidence = this.getTemporalMetricValue("rc", this.rc);
var adjTemporal = adjBase * exploiability * remediationLevel * reportConfidence;
return this._round(adjTemporal, 1);
},
calculateEnvironmentalScore: function(group) {
//Formula: round_to_1_decimal((AdjustedTemporal+(10-AdjustedTemporal)*CollateralDamagePotential)*TargetDistribution)
var env = this.getEnvironmentalMetric(group);
var adjTemp = this.calculateAdjustedTemporal(group);
var collateralDamagePotential = env.cdp;
var targetDistribution = env.td;
var envScore = (adjTemp + (10 - adjTemp) * collateralDamagePotential) * targetDistribution;
return this._round(envScore, 1);
},
getEnvironmentalMetric: function(group) {
var cdp, td, cr, ir, ar;
var groupObject = this.getAssetGroup(group);
var envMetric = {};
if (typeof groupObject == 'object') {
cdp = groupObject.u_cvss_enviro_cdp;
td = groupObject.u_cvss_enviro_td;
cr = groupObject.u_cvss_enviro_cr;
ir = groupObject.u_cvss_enviro_ir;
ar = groupObject.u_cvss_enviro_ar;
var confReq = this.getEnvMetricValue("cr", cr);
var integReq = this.getEnvMetricValue("ir", ir);
var availReq = this.getEnvMetricValue("ar", ar);
var colDamPotent = this.getEnvMetricValue("cdp", cdp);
var targetDist = this.getEnvMetricValue("td", td);
envMetric = {
cr: confReq,
ir: integReq,
ar: availReq,
cdp: colDamPotent,
td: targetDist
};
return envMetric;
} else {
return groupObject;
}
},
//Convert the metric range to numerical value for example
//Collateral Damage Potential of High = 0.5
getEnvMetricValue: function(metric, metricValue) {
if (metricValue == "None") {
return this._getPropertyValue(metric, "none");
} else if (metricValue == "Low") {
return this._getPropertyValue(metric, "low");
} else if (metricValue == "Medium") {
return this._getPropertyValue(metric, "medium");
} else if (metricValue == "Low-Medium") {
return this._getPropertyValue(metric, "low_medium");
} else if (metricValue == "Medium-High") {
return this._getPropertyValue(metric, "medium_high");
} else if (metricValue == "High") {
return this._getPropertyValue(metric, "high");
} else if (metricValue == "Not Defined") {
return this._getPropertyValue(metric, "not_defined");
} else {
return null;
}
},
getTemporalMetricValue: function(metric, metricValue) {
if (metric == "e") {
if (metricValue == "UNPROVEN") {
return this._getPropertyValue(metric, "unproven");
} else if (metricValue == "PROOF_OF_CONCEPT") {
return this._getPropertyValue(metric, "poc");
} else if (metricValue == "FUNCTIONAL") {
return this._getPropertyValue(metric, "func");
} else if (metricValue == "HIGH") {
return this._getPropertyValue(metric, "high");
} else if (metricValue == "NOT_DEFINED") {
return this._getPropertyValue(metric, "not_defined");
}
} else if (metric == "rl") {
if (metricValue == "OFFICIAL_FIX") {
return this._getPropertyValue(metric, "official");
} else if (metricValue == "TEMPORARY_FIX") {
return this._getPropertyValue(metric, "temp");
} else if (metricValue == "WORKAROUND") {
return this._getPropertyValue(metric, "workaround");
} else if (metricValue == "UNAVAILABLE") {
return this._getPropertyValue(metric, "unavailable");
} else if (metricValue == "NOT_DEFINED") {
return this._getPropertyValue(metric, "not_defined");
}
} else if (metric == "rc") {
if (metricValue == "UNCONFIRMED") {
return this._getPropertyValue(metric, "unconfirmed");
} else if (metricValue == "UNCORROBORATED") {
return this._getPropertyValue(metric, "uncorroborated");
} else if (metricValue == "CONFIRMED") {
return this._getPropertyValue(metric, "confirmed");
} else if (metricValue == "NOT_DEFINED") {
return this._getPropertyValue(metric, "not_defined");
}
} else {
return null;
}
},
//Get the base metric numerical value
getBaseMetricValue: function(metric, metricValue) {
if (metric == "av") { // Access vector
if (metricValue == "LOCAL") {
return this._getPropertyValue("av", "local");
} else if (metricValue == "NETWORK") {
return this._getPropertyValue("av", "network");
} else if (metricValue == "ADJACENT_NETWORK") {
return this._getPropertyValue("av", "adjacent_network");
}
} else if (metric == "ac") { // Access complexity
if (metricValue == "HIGH") {
return this._getPropertyValue("ac", "high");
} else if (metricValue == "MEDIUM") {
return this._getPropertyValue("ac", "medium");
} else if (metricValue == "LOW") {
return this._getPropertyValue("ac", "low");
}
} else if (metric == "au") { // Authentication
if (metricValue == "SINGLE_INSTANCE") {
return this._getPropertyValue("au", "single");
} else if (metricValue == "MULTIPLE_INSTANCES") {
return this._getPropertyValue("au", "multiple");
} else {
return this._getPropertyValue("au", "none");
}
} else if (metric == "impact") {
if (metricValue == "PARTIAL") {
return this._getPropertyValue("impact", "partial");
} else if (metricValue == "COMPLETE") {
return this._getPropertyValue("impact", "complete");
} else {
return this._getPropertyValue("impact", "none");
}
} else {
return null;
}
},
//Query asset group by name and return the group object
getAssetGroup: function(sysid) {
var gtag = new GlideRecord('sn_vul_qualys_host_tag');
gtag.get(sysid);
var gr = new GlideRecord("sn_vul_qualys_default_appliance");
gr.addQuery('asset_group_name', gtag.tag_name);
gr.query();
if (gr.next()) {
return gr;
} else {
return gtag.tag_name.toString();
}
},
// Return false if any of the environmental metric is not defined.
checkEnvScoreMetricIsDefined: function(group) {
var cdp, td, cr, ir, ar;
var groupObject = this.getAssetGroup(group);
cdp = groupObject.u_cvss_enviro_cdp;
td = groupObject.u_cvss_enviro_td;
cr = groupObject.u_cvss_enviro_cr;
ir = groupObject.u_cvss_enviro_ir;
ar = groupObject.u_cvss_enviro_ar;
if (cdp == "Not Defined" || td == "Not Defined" || cr == "Not Defined" || ir == "Not Defined" || ar == "Not Defined") {
return false;
} else {
return true;
}
},
//Get the property value of the metric range
_getPropertyValue: function(metric, metricValue) { //metric = "cdp", metricValue = "high"
var str = "sn_vul_qualys.cvss." + metric + "." + metricValue;
var propertyValue = gs.getProperty(str);
if (propertyValue != null)
return parseFloat(propertyValue);
else
return null;
},
_round: function(value, precision) {
var multiplier = Math.pow(10, precision || 0);
return Math.round(value * multiplier) / multiplier;
},
type: 'CVSSMetricUtilsTags'
};(function executeRule(current, previous /*null when async*/) {
new sn_vul_qualys.CheckIPRange().updateAssetGroup(current);
new sn_vul_qualys.CVSSMetricUtils(current).updateEnvironmentalScore();
})(current, previous);assetGroupScan();
executeCalculation();
function assetGroupScan() {
new sn_vul_qualys.CheckIPRange().assetGroupScan();
}
function executeCalculation() {
var gr = new GlideRecord('sn_vul_vulnerable_item');
//gr.addQuery('number', 'VIT0013566');
gr.orderByDesc('number');
gr.query();
gs.info('row count ' + gr.getRowCount());
while (gr.next()) {
new sn_vul_qualys.CVSSMetricUtils(gr).updateEnvironmentalScore();
}
}
var CheckIPRange = Class.create();
CheckIPRange.prototype = {
initialize: function () {},
updateAssetGroup: function (gr) {
groups = this.checkIfInAssetGroup(gr.ip_address.toString());
if (groups == '') {
gr.u_asset_group = "The vulnerable item does not belong to any group";
} else {
gr.u_asset_group = groups.toString();
}
gr.update();
},
assetGroupScan: function () {
var groups;
var gr = new GlideRecord('sn_vul_vulnerable_item');
//gr.addQuery('number', 'VIT0059848');
gr.orderByDesc('number');
//gr.setLimit('10');
gr.query();
//gs.info("COUNT " + gr.getRowCount());
while (gr.next()) {
groups = this.checkIfInAssetGroup(gr.ip_address.toString());
if (groups == '') {
gr.u_asset_group = "The vulnerable item does not belong to any group";
} else {
gr.u_asset_group = groups.toString();
}
gr.update();
}
gs.info("Scheduled Job: Asset group scan completed");
},
checkIfInAssetGroup: function (ipAddress) {
var ipArray, groups = [];
var ipRange = [];
var isInRange, start, end;
var gr = new GlideRecord('sn_vul_qualys_default_appliance');
gr.addNotNullQuery('asset_group_name');
/*gr.addQuery('u_cvss_enviro_cdp', '!=', 'Not Defined');
gr.addQuery('u_cvss_enviro_td', '!=', 'Not Defined');
gr.addQuery('u_cvss_enviro_cr', '!=', 'Not Defined');
gr.addQuery('u_cvss_enviro_ir', '!=', 'Not Defined');
gr.addQuery('u_cvss_enviro_ar', '!=', 'Not Defined');*/
gr.query();
//gs.info("GROUP COUNT: " + gr.getRowCount());
while (gr.next()) {
// for each asset group, get the star and end of each ip and compare with all vulnerable item
// determine if the vulnerable item belong to the asset group
ipRange = [];
//gs.info("Group Name: " + gr.asset_group_name);
ipArray = gr.ips.split(',');
for (var i = 0; i < ipArray.length; i++) {
ipRange[i] = {
start: ipArray[i].split('-')[0],
end: ipArray[i].split('-')[1]
};
}
for (var j = 0; j < ipRange.length; j++) {
start = ipRange[j].start;
end = ipRange[j].end;
if (end == undefined) {
end = start;
}
isInRange = this.checkIpaddrInRange(ipAddress, start, end);
//gs.info(ipAddress + " Start: " + start + " End: " + end + " : " + isInRange);
if (isInRange) {
groups.push(gr.asset_group_name + '');
}
}
}
return groups;
},
/**
* Checks if ipaddr is valid.
* @property {string} ipaddr
* @throws Error
*/
assertIsIpaddr: function (ipaddr) {
if ('string' !== typeof ipaddr && ipaddr) {
gs.error('ipaddr must be a non-empty string');
}
var parts = ipaddr.split(/\./);
if (parts.length !== 4) {
//gs.error('ipaddr must have four octets');
}
var i = 0;
parts.map(function (str) {
var val = parseInt(str);
var octet = 4 - i++;
if (val < 0 || val > 255) {
gs.error('octet ' + octet + ' must be between 0 and 255');
}
});
},
/**
* Converts an ipaddr to a 32bit integer value.
* @property {string} addr - the ipaddr to convert
* @returns {number}
*/
atoi: function (addr) {
// test for validity - will throw!
this.assertIsIpaddr(addr);
// convert octets to numbers
var parts = addr.split('.').map(function (str) {
return parseInt(str);
});
// construct result
var result = (parts[0] ? parts[0] << 24 : 0) + // if > 0, shift 4th octet left by 24
(parts[1] ? parts[1] << 16 : 0) + // if > 0, shift 3rd octet left by 16
(parts[2] ? parts[2] << 8 : 0) + // if > 0, shift 2nd octet left by 8
parts[3];
// note that if all octets are 255, result will overflow
// JavaScript (32bit) number to become -1, so we have to
// special case it. I think throwing an error here is a
// reasonable solution, since 255.255.255.255 is actually
// a broadcast addr.
if (result < 0) {
//gs.error('255.255.255.255 is not a legal host ipaddr');
}
return result;
},
/**
* Checks ipaddr membership within a range of ipaddrs.
* @property {string} ipaddr - ipaddr to check
* @property {string} start - the start of the ipaddr range
* @property {string} end - the end of the ipaddr range
* @returns {boolean} - true if ipaddr is between start and end (inclusive)
*/
checkIpaddrInRange: function (ipaddr, start, end) {
var num = this.atoi(ipaddr);
return (num >= this.atoi(start)) && (num <= this.atoi(end));
},
type: 'CheckIPRange'
};
calculateEnvironmentalScore();
function calculateEnvironmentalScore() {
//Retrieve the vulnerable item
var gr = new GlideRecord('sn_vul_vulnerable_item');
gr.addEncodedQuery('cmdb_ci.sn_vul_qualys_host_tagsISNOTEMPTY');
gr.orderByDesc('number');
//gr.setLimit(5);
gr.query();
while (gr.next()) {
gs.info(gr.number);
new sn_vul_qualys.CVSSMetricUtils(gr).updateEnvironmentalScore();
}
}Create custom fields
Table:sn_vul_qualys_default_appliance
Field:
1. u_cvss_enviro_cdp (Integer)
2. u_cvss_enviro_td (Integer)
3. u_cvss_enviro_cr (Integer)
4. u_cvss_enviro_ir (Integer)
5. u_cvss_enviro_ar (Integer)
Table:sn_vul_vulnerable_item
Field:
1. u_environmental_score_per_group (Large text field)
2. u_environmental_score (Integer)
3. u_asset_groupvar CVSSMetricUtils = Class.create();
CVSSMetricUtils.prototype = {
initialize: function (vulGR) {
this._gr = vulGR;
//Base Metric - Third party
this.av = vulGR.vulnerability.access_vector;
this.ac = vulGR.vulnerability.access_complexity;
this.au = vulGR.vulnerability.authentication;
this.c = vulGR.vulnerability.confidentiality_impact;
this.i = vulGR.vulnerability.integrity_impact;
this.a = vulGR.vulnerability.availability_impact;
//Temporal Metric - Third party
this.e = vulGR.vulnerability.exploitability;
this.rl = vulGR.vulnerability.remediation_level;
this.rc = vulGR.vulnerability.report_confidence;
//Asset Group
this.groups = vulGR.u_asset_group.split(',');
},
updateEnvironmentalScore: function () {
var groupObject;
var groupScore = '';
var highestScore = 0;
var env = 0;
for (var i = 0; i < this.groups.length; i++) {
groupObject = this.getAssetGroup(this.groups[i]);
if (groupObject == '') {
gs.info(this._gr.number + " does not belong to any group");
} else {
//Calculate the score only if the enviornmental metrics are defined.
if (this.checkEnvScoreMetricIsDefined(this.groups[i])) {
env = this.calculateEnvironmentalScore(this.groups[i]);
//Find the highest score
highestScore = env > highestScore ? env : highestScore;
//Generate score for all groups
if (groupScore == '') {
groupScore = groupObject.asset_group_name + ": " + env;
} else {
groupScore += "\n" + groupObject.asset_group_name + ": " + env;
}
} else {
if (groupScore == '') {
groupScore = this.groups[i] + ": Not Defined";
} else {
groupScore += "\n" + this.groups[i] + ": Not Defined";
}
}
}
}
//Update environmental score
this._gr.u_environmental_score_per_group = groupScore;
this._gr.u_environmental_score = highestScore;
this._gr.update();
},
calculateAdjustedImpact: function (group) {
//Formula: min(10,10.41*(1-(1-ConfImpact*ConfReq)*(1-IntegImpact*IntegReq)*(1-AvailImpact*AvailReq)))
var env = this.getEnvironmentalMetric(group);
var confImpact = this.getBaseMetricValue("impact", this.c);
var confReq = env.cr;
var integImpact = this.getBaseMetricValue("impact", this.i);
var integReq = env.ir;
var availImpact = this.getBaseMetricValue("impact", this.a);
var availReq = env.ar;
var adjustedImpact = 10.41 * (1 - (1 - confImpact * confReq) * (1 - integImpact * integReq) * (1 - availImpact * availReq));
adjustedImpact = this._round(adjustedImpact, 1); //Round to 1 decimal
return adjustedImpact > 10 ? 10 : adjustedImpact; // Highest score is 10
},
calculateExploitability: function () {
//Formula: Exploitability = 20 * AccessVector * AccessComplexity * Authentication
var accessVector = this.getBaseMetricValue("av", this.av);
var accessComplexity = this.getBaseMetricValue("ac", this.ac);
var authentication = this.getBaseMetricValue("au", this.au);
var exploitability = 20 * accessVector * accessComplexity * authentication;
return this._round(exploitability, 1);
},
calculateAdjustedBase: function (group) {
//Formula: round_to_1_decimal(((0.6*AdjustedImpact)+(0.4*Exploitability)-1.5)*f(Impact))
//Example: AdjustedBase =((0.6*9.6)+(0.4*10.0)-1.5)*1.176
var adjImpact = this.calculateAdjustedImpact(group);
var exp = this.calculateExploitability();
var f = adjImpact == 0 ? 0 : 1.176;
var adjustedBase = ((0.6 * adjImpact) + (0.4 * exp) - 1.5) * f;
return this._round(adjustedBase, 1);
},
calculateAdjustedTemporal: function (group) {
//Formula: TemporalScore = round_to_1_decimal(BaseScore*Exploitability*RemediationLevel*ReportConfidence)
//TemporalScore recomputed with the BaseScore's Impact sub-equation replaced with the AdjustedImpact equation
var adjBase = this.calculateAdjustedBase(group);
var exploiability = this.getTemporalMetricValue("e", this.e);
var remediationLevel = this.getTemporalMetricValue("rl", this.rl);
var reportConfidence = this.getTemporalMetricValue("rc", this.rc);
var adjTemporal = adjBase * exploiability * remediationLevel * reportConfidence;
return this._round(adjTemporal, 1);
},
calculateEnvironmentalScore: function (group) {
//Formula: round_to_1_decimal((AdjustedTemporal+(10-AdjustedTemporal)*CollateralDamagePotential)*TargetDistribution)
var env = this.getEnvironmentalMetric(group);
var adjTemp = this.calculateAdjustedTemporal(group);
var collateralDamagePotential = env.cdp;
var targetDistribution = env.td;
var envScore = (adjTemp + (10 - adjTemp) * collateralDamagePotential) * targetDistribution;
return this._round(envScore, 1);
},
getEnvironmentalMetric: function (group) {
var cdp, td, cr, ir, ar;
var groupObject = this.getAssetGroup(group);
var envMetric = {};
if (typeof groupObject == 'object') {
cdp = groupObject.u_cvss_enviro_cdp;
td = groupObject.u_cvss_enviro_td;
cr = groupObject.u_cvss_enviro_cr;
ir = groupObject.u_cvss_enviro_ir;
ar = groupObject.u_cvss_enviro_ar;
var confReq = this.getEnvMetricValue("cr", cr);
var integReq = this.getEnvMetricValue("ir", ir);
var availReq = this.getEnvMetricValue("ar", ar);
var colDamPotent = this.getEnvMetricValue("cdp", cdp);
var targetDist = this.getEnvMetricValue("td", td);
envMetric = {
cr: confReq,
ir: integReq,
ar: availReq,
cdp: colDamPotent,
td: targetDist
};
return envMetric;
} else {
return groupObject;
}
},
//Convert the metric range to numerical value for example
//Collateral Damage Potential of High = 0.5
getEnvMetricValue: function (metric, metricValue) {
if (metricValue == "None") {
return this._getPropertyValue(metric, "none");
} else if (metricValue == "Low") {
return this._getPropertyValue(metric, "low");
} else if (metricValue == "Medium") {
return this._getPropertyValue(metric, "medium");
} else if (metricValue == "Low-Medium") {
return this._getPropertyValue(metric, "low_medium");
} else if (metricValue == "Medium-High") {
return this._getPropertyValue(metric, "medium_high");
} else if (metricValue == "High") {
return this._getPropertyValue(metric, "high");
} else if (metricValue == "Not Defined") {
return this._getPropertyValue(metric, "not_defined");
} else {
return null;
}
},
getTemporalMetricValue: function (metric, metricValue) {
if (metric == "e") {
if (metricValue == "UNPROVEN") {
return this._getPropertyValue(metric, "unproven");
} else if (metricValue == "PROOF_OF_CONCEPT") {
return this._getPropertyValue(metric, "poc");
} else if (metricValue == "FUNCTIONAL") {
return this._getPropertyValue(metric, "func");
} else if (metricValue == "HIGH") {
return this._getPropertyValue(metric, "high");
} else if (metricValue == "NOT_DEFINED") {
return this._getPropertyValue(metric, "not_defined");
}
} else if (metric == "rl") {
if (metricValue == "OFFICIAL_FIX") {
return this._getPropertyValue(metric, "official");
} else if (metricValue == "TEMPORARY_FIX") {
return this._getPropertyValue(metric, "temp");
} else if (metricValue == "WORKAROUND") {
return this._getPropertyValue(metric, "workaround");
} else if (metricValue == "UNAVAILABLE") {
return this._getPropertyValue(metric, "unavailable");
} else if (metricValue == "NOT_DEFINED") {
return this._getPropertyValue(metric, "not_defined");
}
} else if (metric == "rc") {
if (metricValue == "UNCONFIRMED") {
return this._getPropertyValue(metric, "unconfirmed");
} else if (metricValue == "UNCORROBORATED") {
return this._getPropertyValue(metric, "uncorroborated");
} else if (metricValue == "CONFIRMED") {
return this._getPropertyValue(metric, "confirmed");
} else if (metricValue == "NOT_DEFINED") {
return this._getPropertyValue(metric, "not_defined");
}
} else {
return null;
}
},
//Get the base metric numerical value
getBaseMetricValue: function (metric, metricValue) {
if (metric == "av") { // Access vector
if (metricValue == "LOCAL") {
return this._getPropertyValue("av", "local");
} else if (metricValue == "NETWORK") {
return this._getPropertyValue("av", "network");
} else if (metricValue == "ADJACENT_NETWORK") {
return this._getPropertyValue("av", "adjacent_network");
}
} else if (metric == "ac") { // Access complexity
if (metricValue == "HIGH") {
return this._getPropertyValue("ac", "high");
} else if (metricValue == "MEDIUM") {
return this._getPropertyValue("ac", "medium");
} else if (metricValue == "LOW") {
return this._getPropertyValue("ac", "low");
}
} else if (metric == "au") { // Authentication
if (metricValue == "SINGLE_INSTANCE") {
return this._getPropertyValue("au", "single");
} else if (metricValue == "MULTIPLE_INSTANCES") {
return this._getPropertyValue("au", "multiple");
} else {
return this._getPropertyValue("au", "none");
}
} else if (metric == "impact") {
if (metricValue == "PARTIAL") {
return this._getPropertyValue("impact", "partial");
} else if (metricValue == "COMPLETE") {
return this._getPropertyValue("impact", "complete");
} else {
return this._getPropertyValue("impact", "none");
}
} else {
return null;
}
},
//Query asset group by name and return the group object
getAssetGroup: function (groupName) {
var gr = new GlideRecord("sn_vul_qualys_default_appliance");
gr.addQuery('asset_group_name', groupName);
gr.query();
if (gr.next()) {
return gr;
} else {
return '';
}
},
// Return false if any of the environmental metric is not defined.
checkEnvScoreMetricIsDefined: function (group) {
var cdp, td, cr, ir, ar;
var groupObject = this.getAssetGroup(group);
cdp = groupObject.u_cvss_enviro_cdp;
td = groupObject.u_cvss_enviro_td;
cr = groupObject.u_cvss_enviro_cr;
ir = groupObject.u_cvss_enviro_ir;
ar = groupObject.u_cvss_enviro_ar;
if (cdp == "Not Defined" || td == "Not Defined" || cr == "Not Defined" || ir == "Not Defined" || ar == "Not Defined") {
return false;
} else {
return true;
}
},
//Get the property value of the metric range
_getPropertyValue: function (metric, metricValue) { //metric = "cdp", metricValue = "high"
var str = "sn_vul_qualys.cvss." + metric + "." + metricValue;
var propertyValue = gs.getProperty(str);
if (propertyValue != null)
return parseFloat(propertyValue);
else
return null;
},
_round: function (value, precision) {
var multiplier = Math.pow(10, precision || 0);
return Math.round(value * multiplier) / multiplier;
},
type: 'CVSSMetricUtils'
};
以上是关于javascript 更新环境评分的主要内容，如果未能解决你的问题，请参考以下文章