Holm Security

Reveal module — This feature requires the Reveal add-on module.

Overview

Holm Security is a cloud-hosted vulnerability and attack surface management platform for system and network security. This asset connector pulls vulnerabilities and correlates them with the network assets enrolled in Holm Security, so Sekoia.io can enrich device assets with active vulnerability exposure.

Vendor: Holm Security
Product: Holm Security System & Network Security
Supported environment: Cloud

Note

This asset connector is currently in beta. Enable the reveal-beta-connectors feature flag to display it.

The asset connector calls GET /v2/net-assets and GET /v2/net-assets/report/vulnerabilities/ on the Holm Security API (https://se-api.holmsecurity.com), to fetch the managed device inventory and the vulnerability findings, respectively. It then correlates each finding to a device and emits an OCSF Vulnerability Finding object.

Configure

How to create an API token

To connect Holm Security to Sekoia.io, you need an API token created by an administrator in the Holm Security web console. Follow these steps:

Sign in to the Holm Security console with an administrator account.
Open Settings and select the API tokens section.
Click Generate token, give it a descriptive name, and confirm.
Copy the token to a safe place and use it in Sekoia.io.

Warning

The API token is displayed only once at creation. Save it securely; if you lose it, you must generate a new one.
Use an administrator account. Both GET /v2/net-assets and GET /v2/net-assets/report/vulnerabilities/ must be reachable, otherwise validation fails.

Create your asset

To start getting your Holm Security vulnerabilities into Sekoia.io, you need to create an asset connector on the Assets page. To do so, follow these steps:

Click the Asset connectors button to create a new connector.
Click the + New connector button.
Choose Holm Security Vulnerabilities, give it a name, and fill the required fields:
- base_url: the base URL of the Holm Security API (default https://se-api.holmsecurity.com).
- api_token: the API token generated in the previous section.
Test the connection by clicking the Test connector button.
Click the Create asset connector button.

OCSF Mapping for Holm Security Vulnerabilities

OCSF Class: Vulnerability Finding

Class UID: 2002

OCSF Version: 1.6.0

Information Collected

The Holm Security Vulnerabilities connector fetches comprehensive information and transforms it into the OCSF (Open Cybersecurity Schema Framework) format for standardized security monitoring and asset management.

API Response Examples

Holm Security Network Asset Vulnerability Sample

Single finding from GET /v2/net-assets/report/vulnerabilities/?assets={uuid}.

{
  "asset": "00000000-0000-0000-0000-000000000000",
  "created_timestamp": "2026-07-03T08:48:31.946465Z",
  "last_detected": "2026-07-03T08:49:31.041067Z",
  "modified_timestamp": "2026-07-03T08:49:31.043282Z",
  "severity": 4,
  "status": 0,
  "port": 5000,
  "protocol": 0,
  "details": "Installed version: 7.3.17\nFixed version: 8.0.30\n",
  "solution": "Update to version 8.0.30, 8.1.22, 8.2.9 or later.",
  "os_details": "Ubuntu 16.04",
  "host": {
    "name": "host-example01.example.com",
    "ip": "192.0.2.20"
  },
  "vuln": {
    "hid": "HID-2-1-304086",
    "name": "PHP < 8.0.30, 8.1.x < 8.1.22, 8.2.x < 8.2.9 Security Update - Linux",
    "created": "2024-09-26T17:13:43.909000Z",
    "modified": "2024-09-26T17:13:43.909000Z",
    "score": 9.4,
    "cves": ["CVE-2023-3823"],
    "vuln": {
      "base_score_v2": 9.7,
      "base_score_v3": 9.4,
      "patch_avail": false,
      "summary": "PHP is prone to multiple vulnerabilities.",
      "solution": "Update to version 8.0.30, 8.1.22, 8.2.9 or later.",
      "vendor_ref": "URL:https://www.php.net/ChangeLog-8.php#8.1.22",
      "exploit_ref": "URL:https://example.com/xdb/e9567ccc6e41"
    },
    "vuln_category": {
      "id": 5,
      "name": "General"
    }
  }
}

Data Mapping Table

The following table shows how source data is mapped to OCSF model fields:

Source Field	OCSF Field Path	Description	Data Type	Logic
`status`	`activity_id`	OCSF activity ID	`integer`	0 -> 1 Create; 1 and 2 -> 2 Update; 3 -> 3 Close; null or unknown -> 1 Create
`status`	`activity_name`	OCSF activity name	`string`	0 -> 'Create'; 1 and 2 -> 'Update'; 3 -> 'Close'; null or unknown -> 'Create'
`status`	`type_uid`	OCSF type UID	`integer`	0 -> 200201; 1 and 2 -> 200202; 3 -> 200203; null or unknown -> 200201
`status`	`type_name`	OCSF type name	`string`	'Vulnerability Finding: ' + activity_name
`static: Findings`	`category_name`	OCSF category name	`string`	Always 'Findings'
`static: 2`	`category_uid`	OCSF category UID	`integer`	Always 2 for Findings category
`static: Vulnerability Finding`	`class_name`	OCSF class name	`string`	Always 'Vulnerability Finding'
`static: 2002`	`class_uid`	OCSF class UID	`integer`	Always 2002 for Vulnerability Finding
`severity`	`severity`	OCSF severity string	`string`	0->Informational, 1->Low, 2->Medium, 3->High, 4->Critical, else Unknown
`severity`	`severity_id`	OCSF severity id	`integer`	severity + 1 if in [0,4], else 0
`last_detected`	`time`	OCSF event timestamp	`timestamp`	Convert ISO 8601 last_detected to Unix epoch; fall back to modified_timestamp
`modified_timestamp`	`checkpoint`	Client-side incremental collection cursor	`timestamp`	Collection cursor, falling back to last_detected. A finding that changes status is modified without being detected again, so last_detected alone would suppress the Close event
`static: Holm Security`	`metadata.product.name`	Source product name	`string`	Always 'Holm Security'
`static: Holm Security`	`metadata.product.vendor_name`	Vendor name	`string`	Always 'Holm Security'
`static: 1.6.0`	`metadata.version`	OCSF schema version	`string`	Fixed OCSF schema version
`vuln.hid`	`finding_info.uid`	Finding unique identifier	`string`	Vulnerability definition id; 'unknown' fallback
`vuln.name`	`finding_info.title`	Finding title	`string`	Direct mapping of vulnerability name
`vuln.vuln.summary`	`finding_info.desc`	Finding description	`string`	Direct mapping of vulnerability summary
`vuln.vuln_category.name`	`finding_info.types`	Finding category	`array`	Single element list; omitted when the category is missing
`vuln.created`	`finding_info.created_time`	Vulnerability definition creation time	`timestamp`	Convert ISO 8601 to Unix epoch integer
`created_timestamp`	`finding_info.first_seen_time`	First detection of the finding	`timestamp`	Convert ISO 8601 to Unix epoch integer
`last_detected`	`finding_info.last_seen_time`	Last detection of the finding	`timestamp`	Convert ISO 8601 to Unix epoch integer
`vuln.cves[]`	`vulnerabilities[].cve.uid`	CVE identifier	`string`	One VulnerabilityDetails entry per CVE; a single entry with no CVE when the list is empty
`vuln.vuln.base_score_v2`	`vulnerabilities[].cve.cvss[].base_score`	CVSS v2 base score	`float`	CVSS v2.0 base score; emitted whenever the field is present, 0.0 included
`vuln.vuln.base_score_v3`	`vulnerabilities[].cve.cvss[].base_score`	CVSS v3 base score	`float`	CVSS v3.0 base score; emitted whenever the field is present, 0.0 included
`vuln.vuln.patch_avail`	`vulnerabilities[].is_fix_available`	Whether a fix is available	`boolean`	Direct mapping of patch availability
`vuln.vuln.vendor_ref / vuln.vuln.exploit_ref`	`vulnerabilities[].references`	Vulnerability references	`array`	Non-empty references collected in order; omitted when both are missing
`asset`	`device.uid`	Device unique identifier	`string`	UUID of the network asset the finding belongs to
`net_assets.hostname`	`device.hostname`	Device hostname	`string`	Hostname of the correlated network asset; falls back to host.name, then to an empty string
`static: Unknown`	`device.type / device.type_id`	Device type	`string`	Always 'Unknown' (0): the device type is carried by the device asset connector

OCSF Model Structure

Vulnerability Finding: Create

Transformed Holm Security network asset vulnerability to an OCSF Vulnerability Finding event

{
  "activity_id": 1,
  "activity_name": "Create",
  "category_name": "Findings",
  "category_uid": 2,
  "class_name": "Vulnerability Finding",
  "class_uid": 2002,
  "type_name": "Vulnerability Finding: Create",
  "type_uid": 200201,
  "severity": "Critical",
  "severity_id": 5,
  "time": 1751532571.041067,
  "metadata": {
    "product": {
      "name": "Holm Security",
      "vendor_name": "Holm Security"
    },
    "version": "1.6.0"
  },
  "finding_info": {
    "uid": "HID-2-1-304086",
    "title": "PHP < 8.0.30, 8.1.x < 8.1.22, 8.2.x < 8.2.9 Security Update - Linux",
    "desc": "PHP is prone to multiple vulnerabilities.",
    "types": ["General"],
    "created_time": 1727370823,
    "first_seen_time": 1751532511,
    "last_seen_time": 1751532571
  },
  "vulnerabilities": [
    {
      "cve": {
        "uid": "CVE-2023-3823",
        "type": "CVE",
        "title": "PHP < 8.0.30, 8.1.x < 8.1.22, 8.2.x < 8.2.9 Security Update - Linux",
        "desc": "PHP is prone to multiple vulnerabilities.",
        "cvss": [
          {"version": "2.0", "base_score": 9.7},
          {"version": "3.0", "base_score": 9.4}
        ]
      },
      "title": "PHP < 8.0.30, 8.1.x < 8.1.22, 8.2.x < 8.2.9 Security Update - Linux",
      "desc": "PHP is prone to multiple vulnerabilities.",
      "references": [
        "URL:https://www.php.net/ChangeLog-8.php#8.1.22",
        "URL:https://example.com/xdb/e9567ccc6e41"
      ],
      "severity": "Critical",
      "vendor_name": "Holm Security",
      "is_fix_available": false
    }
  ],
  "device": {
    "uid": "00000000-0000-0000-0000-000000000000",
    "hostname": "host-example01.example.com",
    "type": "Unknown",
    "type_id": 0
  }
}