quaxar-asm-vulnerabilities
Get vulnerabilities related to exposed assets from the S2W Quaxar ASM service.
Syntax
Options
- profile=STRING
- Optional. QUAXAR connect profile code. If omitted, an available profile is used automatically.
- cve=STRING
- Optional. CVE code to search.
- epss-grades=STRING
- Optional. Comma-separated EPSS grades to filter. Allowed values: HIGH, MEDIUM, LOW.
- cvss-grades=STRING
- Optional. Comma-separated CVSS grades to filter. Allowed values: CRITICAL, HIGH, MEDIUM, LOW.
- softwares=STRING
- Optional. Comma-separated software names to filter.
- related=BOOL
- Optional. Set t to filter vulnerabilities with related assets.
- orgs=STRING
- Optional. Comma-separated customer organization names.
- sorts=STRING
- Optional. Sort order. Allowed values: detected_time_desc, detected_time_asc, epss_desc, epss_asc, cvss_desc, cvss_asc, related_software_count_desc, related_software_count_asc.
- duration=STRING
- Optional. Scan only recent data. Use s(second), m(minute), h(hour), d(day), mon(month) time unit. e.g. 7d.
- from=STRING
- Optional. Start time of range in yyyyMMddHHmmss format. If you omit the time part, it is padded by zero.
- to=STRING
- Optional. End time of range in yyyyMMddHHmmss format. Cannot be used alone; specify with from or duration.
- pretty=BOOL
- Optional. Set t to enable pretty print with line breaks (default: f).
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | string | Connect profile | Profile name of QUAXAR |
| vulnerability_id | string | Vulnerability ID | Vulnerability unique ID |
| cve_code | string | CVE code | CVE code |
| epss | float | EPSS | EPSS score |
| epss_grade | string | EPSS grade | HIGH, MEDIUM or LOW |
| cvss | float | CVSS | CVSS score |
| cvss_grade | string | CVSS grade | CRITICAL, HIGH, MEDIUM or LOW |
| related_softwares | string | Related softwares | Newline-separated related softwares |
| affected_assets | string | Affected assets | Affected asset list (JSON) |
| detected | date | Detected | Vulnerability detection time |
| confirmed | boolean | Confirmed | Version-confirmed related vulnerability or not |
| potential | boolean | Potential | Version-unconfirmed related vulnerability or not |
Error codes
Parsing errors
| Error message | Cause | Resolution |
|---|---|---|
| Specify valid Quaxar profile. | Invalid profile in the profile option | Specify a valid Quaxar connect profile code |
| No available Quaxar profile found. | No Quaxar connect profile registered | Register a Quaxar connect profile first |
| Invalid epss-grades. Available grades are HIGH, MEDIUM, LOW. | Disallowed grade value in epss-grades | Specify one of HIGH, MEDIUM, LOW |
| Invalid cvss-grades. Available grades are CRITICAL, HIGH, MEDIUM, LOW. | Disallowed grade value in cvss-grades | Specify one of CRITICAL, HIGH, MEDIUM, LOW |
| Invalid sorts. Available sorts are detected_time_desc, detected_time_asc, epss_desc, epss_asc, cvss_desc, cvss_asc, related_software_count_desc, related_software_count_asc. | Disallowed value in sorts | Use one of the allowed sort orders |
| Invalid duration. Use s(second), m(minute), h(hour), d(day), mon(month) time unit. (e.g. 7d) | Malformed duration | Use the specified time unit format |
| Specify from or duration option. | to specified without from or duration | Specify from or duration with to |
Runtime errors
| Error message | Cause | Resolution |
|---|---|---|
| quaxar asm api error: status=..., message=... | ASM API returned an error state | Check profile permission and ASM service |
Description
quaxar-asm-vulnerabilities is a source command that iterates the list of vulnerabilities the Quaxar ASM found on exposed assets page by page, emitting each vulnerability as a row. Every row carries the connect profile name used for the query in the profile field.
epss (exploit probability score) and cvss (severity score) are returned as floats and can be filtered by their grades (epss_grade, cvss_grade). confirmed indicates a related vulnerability on version-confirmed assets, and potential indicates one on version-unconfirmed assets. Use related=t to narrow to vulnerabilities that actually have related assets. affected_assets is returned as a JSON string.
Examples
Example: Prioritize vulnerabilities with high exploit probability
Situation: You want to review vulnerabilities related to actual exposed assets with high exploit probability (EPSS), sorted by descending EPSS score, to set remediation priority.
Expected result:
| cve_code | epss | epss_grade | cvss | cvss_grade | related_softwares |
|---|---|---|---|---|---|
| CVE-2023-47145 | 5.347 | LOW | 8.4 | HIGH | nginx |
| CVE-2024-10001 | 42.10 | HIGH | 9.1 | CRITICAL | db2 |
Interpretation: Vulnerabilities with high exploit probability are sorted to the top. Use the vulnerability_id with the quaxar-asm-vulnerability command to look up the CVE description and affected software detail.