Upwind Vulnerability Detection Passthrough

AnalysisType: rule
RuleID: Upwind.Detection.Vulnerability.Passthrough
DisplayName: Upwind Vulnerability Detection Passthrough
Description: >
  Re-raises Upwind vulnerability detections in Panther. Covers exploitable CVEs identified
  in runtime containers, VMs, and serverless environments, prioritized by active exposure.
Runbook: |
  1. Check whether resource.internet_exposure.ingress.active_communication is true and review resource.risk_categories to assess the blast radius of the vulnerability on resource.name in resource.cloud_account_id
  2. Query Upwind.Detections for all vulnerability detections on the same resource.name in the past 90 days to evaluate patch cadence and determine if this finding is recurring
  3. Search for runtime or network threat detections against the same resource.name or resource.cloud_account_id in the past 30 days to determine whether the vulnerability has already been exploited
Reference: https://docs.upwind.io/restapi/v1/get-threat-detection
Enabled: true
Filename: upwind_vulnerability_detection_passthrough.py
Severity: Medium
Status: Experimental
LogTypes:
  - Upwind.Detections
DedupPeriodMinutes: 1440
Threshold: 1
Reports:
  MITRE ATT&CK:
    - TA0001:T1190  # Initial Access: Exploit Public-Facing Application
Tags:
  - Upwind
  - Passthrough
  - Vulnerability
  - Initial Access
  - Exploit Public-Facing Application
Tests:
  - Name: Critical Vulnerability Detection
    ExpectedResult: true
    Log:
      {
        "p_event_time": "2026-03-18T14:00:00Z",
        "p_log_type": "Upwind.Detections",
        "p_row_id": "bb2233cc4455bb2233cc4455bb2233cc",
        "p_schema_version": 0,
        "category": "Vulnerability",
        "description": "Critical CVE-2024-1234 detected in a runtime container image.",
        "first_seen_time": "2026-03-18T13:50:00Z",
        "id": "det-vuln-001",
        "last_seen_time": "2026-03-18T14:00:00Z",
        "occurrence_count": 1,
        "severity": "CRITICAL",
        "status": "open",
        "title": "Critical Vulnerability in Runtime Container",
        "type": "vulnerability",
        "upwind_console_link": "https://console.upwind.io/detections/det-vuln-001",
        "resource": {
          "cloud_account_id": "123456789012",
          "cloud_account_name": "prod-aws",
          "cloud_provider": "AWS",
          "cluster_id": "cluster-abc123",
          "name": "frontend-pod",
          "namespace": "production",
          "region": "us-east-1",
          "type": "Pod",
          "upwind_asset_id": "asset-vuln-001",
          "risk_categories": ["internet_facing", "critical_workload"],
          "internet_exposure": {
            "ingress": {
              "active_communication": true
            }
          }
        },
        "mitre_attacks": [
          {
            "tactic_id": "TA0001",
            "tactic_name": "Initial Access",
            "technique_id": "T1190",
            "technique_name": "Exploit Public-Facing Application"
          }
        ],
        "triggers": [
          {
            "policy_id": "pol-vuln-001",
            "policy_name": "Critical Runtime CVE Policy",
            "events": []
          }
        ]
      }
  - Name: Non-Vulnerability Category - Not Matched
    ExpectedResult: false
    Log:
      {
        "p_event_time": "2026-03-18T14:00:00Z",
        "p_log_type": "Upwind.Detections",
        "p_row_id": "cc3344dd5566cc3344dd5566cc3344dd",
        "p_schema_version": 0,
        "category": "API Threat",
        "description": "Broken auth on API.",
        "first_seen_time": "2026-03-18T13:50:00Z",
        "id": "det-api-003",
        "last_seen_time": "2026-03-18T14:00:00Z",
        "occurrence_count": 2,
        "severity": "HIGH",
        "status": "open",
        "title": "Broken Authentication",
        "type": "api_threat",
        "resource": {
          "cloud_account_id": "123456789012",
          "name": "api-service",
          "region": "us-east-1",
          "type": "Service"
        },
        "mitre_attacks": [],
        "triggers": []
      }
  - Name: Vulnerability Category with Unknown Severity - Suppressed
    ExpectedResult: false
    Log:
      {
        "p_event_time": "2026-03-18T14:00:00Z",
        "p_log_type": "Upwind.Detections",
        "p_row_id": "dd4455ee6677dd4455ee6677dd4455ee",
        "p_schema_version": 0,
        "category": "Vulnerabilities",
        "description": "Low-priority informational CVE detected.",
        "first_seen_time": "2026-03-18T13:50:00Z",
        "id": "det-vuln-002",
        "last_seen_time": "2026-03-18T14:00:00Z",
        "occurrence_count": 1,
        "severity": "INFO",
        "status": "open",
        "title": "Low-Priority CVE Detected",
        "type": "vulnerability",
        "resource": {
          "cloud_account_id": "123456789012",
          "name": "batch-job-pod",
          "region": "us-west-2",
          "type": "Pod"
        },
        "mitre_attacks": [],
        "triggers": []
      }


# ------ paired body: upwind_vulnerability_detection_passthrough.py ------

from panther_upwind_helpers import (
    upwind_base_alert_context,
    upwind_is_known_severity,
    upwind_severity,
    upwind_triggered_policies,
)

# Upwind vulnerability detections surface exploitable CVEs in runtime
# containers, VMs, and serverless environments, prioritized by actual exposure.
VULNERABILITY_KEYWORDS = ("vulnerab",)  # matches "vulnerability" and "vulnerabilities"

# Defer to higher-priority rules when their keywords also appear in the category
VULNERABILITY_EXCLUSIONS = ("api",)


def rule(event):
    category = event.get("category", "").lower()
    return (
        upwind_is_known_severity(event)
        and any(kw in category for kw in VULNERABILITY_KEYWORDS)
        and not any(ex in category for ex in VULNERABILITY_EXCLUSIONS)
    )


def title(event):
    return f"[Upwind Vulnerability]: {event.get('title', '<NO TITLE>')}"


def severity(event):
    return upwind_severity(event)


def dedup(event):
    return f"{event.get('id', '<NO ID>')}_{event.get('severity', '<NO SEVERITY>')}"


def description(event):
    return event.get("description") or "DEFAULT"


def reference(event):
    return event.get("upwind_console_link") or "DEFAULT"


def alert_context(event):
    ctx = upwind_base_alert_context(event)
    ctx["triggered_policies"] = upwind_triggered_policies(event)
    return ctx