N

Official

NVD source integration documentation

Name: CloudQuery NVD Integration
Author: CloudQuery

This plugin is in preview.

Sync vulnerability data from NVD to any supported CloudQuery destination.

Publisher

cloudquery

Latest version

v1.1.4

Type

Source

Platforms

Date Published

Start Syncing

nvd_cves

NVD CVEs

The nvd_cves table shows data for NVD CVEs.

This table supports incremental syncing. Read more about incremental syncing here.

CVE records from the NIST National Vulnerability Database, including CVSS base scores, CWE identifiers, CPE applicability statements and CISA KEV enrichment.

API docs: https://nvd.nist.gov/developers/vulnerabilities

Table Options #

CVEsTableOptions configures the nvd_cves table.

start_date (Time)
Only sync CVE records published on or after this time. Omit to sync the full history, around 389,000 records.
end_date (Time)
Only sync CVE records published on or before this time. Requires start_date.
cve_ids ([]string) (nullable)
Only sync these specific CVE records, at most 100 of them.
cpe_name (string)
Only sync CVE records matching this CPE name, whose part, vendor, product and version must not be *.
is_vulnerable (boolean)
Only sync CVE records where cpe_name is itself marked vulnerable rather than merely referenced.
cwe_id (string)
Only sync CVE records carrying this weakness, for example CWE-79; NVD also matches related weaknesses.
cvss_v3_severity (string) (possible values: LOW, MEDIUM, HIGH, CRITICAL)
Only sync CVE records whose NVD-assigned CVSS v3 severity matches, which excludes records NVD never scored.
keyword_search (string)
Only sync CVE records whose description contains every one of these words, each matched as a prefix.
has_kev (boolean)
Only sync CVE records listed in the CISA Known Exploited Vulnerabilities catalog.
no_rejected (boolean)
Exclude CVE records that have been rejected. They are included by default, matching NVD.

Time #

CloudQuery configtype.Time

Allows for defining timestamps in both absolute(RFC3339) and relative formats. Absolute timestamp example: 2024-01-01T12:00:00+00:00. Relative timestamps can take this format:

now
x seconds [ago|from now]
x minutes [ago|from now]
x hours [ago|from now]
x days [ago|from now]until field usage:
until: now
until: 2 days ago
until: 10 months 3 days 4h20m from now
until: 2024-01-01T12:00:00+00:00

(string) (pattern:

(^now$|^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(.(\\d{1,9}))?(Z|((-|\\+)\\d{2}:\\d{2}))$|^\\d{4}-\\d{2}-\\d{2}$|^[-+]?([0-9]*(\\.[0-9]*)?[a-z]+)+$|^(([0-9]+\\s+(nanoseconds?|ns|microseconds?|us|µs|μs|milliseconds?|ms|seconds?|s|minutes?|m|hours?|h|days?|d|months?|M|years?|Y)|[-+]?([0-9]*(\\.[0-9]*)?[a-z]+)+))(\\s+(([0-9]+\\s+(nanoseconds?|ns|microseconds?|us|µs|μs|milliseconds?|ms|seconds?|s|minutes?|m|hours?|h|days?|d|months?|M|years?|Y)|[-+]?([0-9]*(\\.[0-9]*)?[a-z]+)+)))*\\s+(ago|from\\s+now)$)

)

Primary Keys #

Name	Type
id	`utf8`

Incremental Sync Keys #

Name	Type
last_modified	`timestamp[us, tz=UTC]`

Columns #

Name	Type
affected	`json`
cisa_action_due	`timestamp[us, tz=UTC]`
cisa_exploit_add	`timestamp[us, tz=UTC]`
cisa_required_action	`utf8`
cisa_vulnerability_name	`utf8`
configurations	`json`
_cq_id	`uuid`
_cq_parent_id	`uuid`
cve_references	`json`
cve_tags	`json`
cvss_base_score	`float64`
cvss_base_severity	`utf8`
cvss_exploitability_score	`float64`
cvss_impact_score	`float64`
cvss_source	`utf8`
cvss_type	`utf8`
cvss_v2_base_score	`float64`
cvss_v2_base_severity	`utf8`
cvss_v2_vector_string	`utf8`
cvss_v30_base_score	`float64`
cvss_v30_base_severity	`utf8`
cvss_v30_vector_string	`utf8`
cvss_v31_base_score	`float64`
cvss_v31_base_severity	`utf8`
cvss_v31_vector_string	`utf8`
cvss_v40_base_score	`float64`
cvss_v40_base_severity	`utf8`
cvss_v40_vector_string	`utf8`
cvss_vector_string	`utf8`
cvss_version	`utf8`
cwe_ids	`list<item: utf8, nullable>`
description	`utf8`
descriptions	`json`
evaluator_comment	`utf8`
evaluator_impact	`utf8`
evaluator_solution	`utf8`
id	`utf8`
is_kev	`bool`
last_modified	`timestamp[us, tz=UTC]`
metrics	`json`
published	`timestamp[us, tz=UTC]`
source_identifier	`utf8`
vendor_comments	`json`
vuln_status	`utf8`
weaknesses	`json`

Loading plugin tables

Table Options #

CVEsTableOptions configures the nvd_cves table.

start_date (Time)

Only sync CVE records published on or after this time. Omit to sync the full history, around 389,000 records.

end_date (Time)

Only sync CVE records published on or before this time. Requires start_date.

cve_ids ([]string) (nullable)

Only sync these specific CVE records, at most 100 of them.

cpe_name (string)

Only sync CVE records matching this CPE name, whose part, vendor, product and version must not be *.

is_vulnerable (boolean)

Only sync CVE records where cpe_name is itself marked vulnerable rather than merely referenced.

cwe_id (string)

Only sync CVE records carrying this weakness, for example CWE-79; NVD also matches related weaknesses.

cvss_v3_severity (string) (possible values: LOW, MEDIUM, HIGH, CRITICAL)

Only sync CVE records whose NVD-assigned CVSS v3 severity matches, which excludes records NVD never scored.

keyword_search (string)

Only sync CVE records whose description contains every one of these words, each matched as a prefix.

has_kev (boolean)

Only sync CVE records listed in the CISA Known Exploited Vulnerabilities catalog.

no_rejected (boolean)

Exclude CVE records that have been rejected. They are included by default, matching NVD.

Time #

CloudQuery configtype.Time

Allows for defining timestamps in both absolute(RFC3339) and relative formats. Absolute timestamp example: 2024-01-01T12:00:00+00:00. Relative timestamps can take this format:

now

x seconds [ago|from now]

x minutes [ago|from now]

x hours [ago|from now]

x days [ago|from now]until field usage:

until: now

until: 2 days ago

until: 10 months 3 days 4h20m from now

until: 2024-01-01T12:00:00+00:00

(string) (pattern:

(^now$|^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(.(\\d{1,9}))?(Z|((-|\\+)\\d{2}:\\d{2}))$|^\\d{4}-\\d{2}-\\d{2}$|^[-+]?([0-9]*(\\.[0-9]*)?[a-z]+)+$|^(([0-9]+\\s+(nanoseconds?|ns|microseconds?|us|µs|μs|milliseconds?|ms|seconds?|s|minutes?|m|hours?|h|days?|d|months?|M|years?|Y)|[-+]?([0-9]*(\\.[0-9]*)?[a-z]+)+))(\\s+(([0-9]+\\s+(nanoseconds?|ns|microseconds?|us|µs|μs|milliseconds?|ms|seconds?|s|minutes?|m|hours?|h|days?|d|months?|M|years?|Y)|[-+]?([0-9]*(\\.[0-9]*)?[a-z]+)+)))*\\s+(ago|from\\s+now)$)

)

Name

Type

utf8

Name

Type

last_modified

timestamp[us, tz=UTC]

Name

Type

affected

json

cisa_action_due

timestamp[us, tz=UTC]

cisa_exploit_add

timestamp[us, tz=UTC]

cisa_required_action

utf8

cisa_vulnerability_name

utf8

configurations

json

_cq_id

uuid

_cq_parent_id

uuid

cve_references

json

cve_tags

json

cvss_base_score

float64

cvss_base_severity

utf8

cvss_exploitability_score

float64

cvss_impact_score

float64

cvss_source

utf8

cvss_type

utf8

cvss_v2_base_score

float64

cvss_v2_base_severity

utf8

cvss_v2_vector_string

utf8

cvss_v30_base_score

float64

cvss_v30_base_severity

utf8

cvss_v30_vector_string

utf8

cvss_v31_base_score

float64

cvss_v31_base_severity

utf8

cvss_v31_vector_string

utf8

cvss_v40_base_score

float64

cvss_v40_base_severity

utf8

cvss_v40_vector_string

utf8

cvss_vector_string

utf8

cvss_version

utf8

cwe_ids

list<item: utf8, nullable>

description

utf8

descriptions

json

evaluator_comment

utf8

evaluator_impact

utf8

evaluator_solution

utf8

is_kev

bool

last_modified

timestamp[us, tz=UTC]

metrics

json

published

timestamp[us, tz=UTC]

source_identifier

utf8

vendor_comments

json

vuln_status

utf8

weaknesses

json