About security vulnerability importers

This topic describes the conversion mechanism used by a security vulnerability importer, shipped importer, and a sample stylesheet that you can use as a template.

Conversion mechanisms

A security vulnerability importer converts a vendor's source file into the BMC Network Automation internal format, then parses that internal format to populate a security vulnerability into the BMC Network Automation security vulnerability database. An importer can convert a vendor's source file in one of the following ways:

• Conversion using a stylesheet: If the vendor provides an XML file, you can develop a stylesheet using the XSLT version 2.0 syntax that parses the XML file into the internal XML format that is supported by BMC Network Automation.
• Conversion using an executable script or program: If the vendor provides any other type of file that can be parsed, you can develop a script or program and place it in the BCAN_DATA\endorsed directory. This script or program converts the source file into the internal XML format. The script or program must accept one argument that specifies the name of the source file, and must print the converted results to its standard output (stdout). The program or script must exit with a return code of 0 to indicate success, and any other value to indicate failure.
• No conversion: Manually-generated file that is already in the BMC Network Automation internal XML format and does not need conversion.

Importer shipped with BMC Network Automation

BMC Network Automation is shipped with one canned importer, named Import Cisco Advisory From CVRF XML File, which supports the import of security advisories from the Cisco Common Vulnerability Reporting Framework (CVRF) repository. This importer uses a stylesheet that detects references to the supported devices in Cisco's CVRF files. You might want to use this importer's stylesheet as an example to develop your own stylesheets. When you upgrade BMC Network Automation, the stylesheet of this importer is replaced by the shipped version. If you have customized this stylesheet, it will be saved in a backup version of the importer. You can delete the backup importer if not needed.

BMC Network Automation internal XML format

The BMC Network Automation internal format defines an XML structure that captures all the attributes of a security vulnerability supported by BMC Network Automation. The exact format is defined in the SecurityVulnerability.xsd file, which is included in the BCAN_HOME\public\bmc\bca-networks\xml directory.

The following is an example of the BMC Network Automation internal format that includes all the available elements. You can use this format as a template.

<?xml version="1.0" encoding="UTF-8"?>
<securityVulnerability>
    <!-- id and title are required -->
    <id> unique ID string within the vendor (required) </id>
    <title> a descriptive title (required) </title>

    <!-- the rest is optional -->
    <status> string describing state of this report </status>
    <!-- date/time this report was initially released; must match format
         yyyy-MM-dd'T'HH:mm:ss or yyyy-MM-dd'T'HH:mm:ssX
         (per java SimpleDateFormat syntax) -->
    <initialRelease>2014-05-21T16:00:00</initialRelease>
    <!-- dotted set of numbers; used when re-importing to detect a newer
         version of an existing vulnerability -->
    <version>1.0</version>
    <!-- URL to vendor's full report, since what is imported is a summary -->
    <notificationUrl> http://URL </notificationUrl>
    <!-- identifier(s) into Mitre's CVE database -->
    <cveId> CVE-2013-5503 </cveId>
    <cveId> CVE-2013-5504 </cveId>    <!-- can have multiple cveId tags -->
    <!-- severity, ranges from 0.0 to 10.0 -->
    <baseScore> 7.0 </baseScore>
    <!-- product(s) that are vulnerable to the security threat, one per
         operating system version -->
    <product>
       <affectedProductName> descriptive name of the product </affectedProductName>
       <affectedOsVersion> vulnerable version that can be mapped to a BNA version string </affectedOsVersion>
       <deviceType> Cisco IOS Switch/Router </deviceType> <~-- name or GUID -->
    </product>
    <product>
       <affectedProductName> descriptive name of the product </affectedProductName>
       <unenforceableVersion> some version that cannot be mapped to a BNA version string </unenforceableVersion>
    </product>
    <description> detailed description of the issue </description>
    <description> ...can have multiple descriptions </description>
    <remediation> instructions for working around or correcting the issue </remediation>
    <remediation> ...can have multiple remediaions </remediation>
</securityVulnerability>

This template includes the following elements: