LocateRisk Cyberrisk Analysis

Overview

LocateRisk is a specialist for automated IT risk analysis and monitoring. The Cyberrisk Analysis report contains vulnerabilities discovered by LocateRisk's cyber risk analysis platform, including network, web, DNS, and application findings detected per host with their CVSS and EPSS context.

Vendor: LocateRisk
Supported environment: SaaS
Detection based on: Alert
Supported application or feature:
- Vulnerability findings (network, web, DNS, application)
- Risk scoring context (CVSS and EPSS)

Configure

Prerequisites

Before starting, ensure you have:

A LocateRisk account with API access on app.locaterisk.com
A LocateRisk API key
The identifier (scan_id) of the LocateRisk scan you want to ingest
An intake key from your Sekoia.io CyberRisk Analysis intake

Configuration Procedure

1. Create an API token in LocateRisk

Log in to your LocateRisk account
Generate a personal API key from the account settings
Copy the API key
Note the identifier (scan_id) of the scan you want to ingest findings from

2. Create a LocateRisk intake in Sekoia.io

Go to your Sekoia.io Intakes page and follow these steps:

Click on + Intake to create a new one
Search for the CyberRisk Analysis format, give it a name and choose the relevant Entity
Click on Create

3. Configure connector parameters

Mandatory parameters:

API key: the LocateRisk API key generated in the previous section
Scan ID: the identifier of the LocateRisk scan to export

Optional parameters:

Report URL: base URL of the LocateRisk report export endpoint. Default: https://app.locaterisk.com/api/rest/report/export
Polling interval: how often, in minutes, the connector polls LocateRisk for new findings. Default: 5

Once configured, the connector polls the scan report as CSV from <report_url>/<scan_id>/csv, parses each row as a finding, tags events with source=locaterisk, and ingests them as structured events.

Validation

Verify that the connector starts successfully from the intake page.
Confirm that findings appear on the Events page.
On subsequent polls, unchanged rows are not resent; only new or changed rows are ingested.

Behavior Notes

The report is polled as a full snapshot at each cycle.
To avoid duplicates, only new or changed rows are forwarded after the first successful poll.
The connector accepts only HTTPS values for report_url.

Troubleshooting

401/403 errors: verify that your API key is valid and still authorized in LocateRisk.
404 errors: verify that scan_id and report_url target a valid LocateRisk report export endpoint.
No events after initial ingestion: if the report has not changed, this behavior is expected due to row-level deduplication.

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

test_app_with_cvestest_multiple_cvestest_multiple_tagstest_network_findingtest_web_finding

{
    "date": "2024-01-15T10:00:00.000Z",
    "risk": 5,
    "score": 0,
    "cvss": 9.1,
    "ip": "192.0.2.3",
    "location": "http://192.0.2.3, https://192.0.2.3",
    "type": "app_nested",
    "id": "Http Server",
    "details": "1 system with possibly patched vulnerability found",
    "uid": "cccc2222dddd3333eeee4444ffff5555aaaa0000bbbb1111cccc2222dddd3333",
    "link": "https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000003/host?ip=192.0.2.3",
    "falsepositive": "[fp]",
    "contact": "",
    "comment": "",
    "tags": "",
    "problem": "Outdated software may contain known exploits.",
    "risks": "Attackers can execute code remotely via known CVEs.",
    "measures": "Upgrade to the latest supported software version.",
    "epss": "0.03%",
    "cves": "CVE-2024-11111 (cvss: 9.1, epss: 0.03%)"
}

{
    "date": "2024-01-15T11:00:00.000Z",
    "risk": 8,
    "score": 0,
    "cvss": 9.1,
    "ip": "192.0.2.4",
    "location": "192.0.2.4:443",
    "type": "app_nested",
    "id": "Apache HTTP Server",
    "details": "3 systems with critical vulnerabilities found",
    "uid": "dddd3333eeee4444ffff5555aaaa0000bbbb1111cccc2222dddd3333eeee4444",
    "link": "https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000004/host?ip=192.0.2.4",
    "falsepositive": "",
    "contact": "",
    "comment": "",
    "tags": "",
    "problem": "Outdated Apache version with known exploits.",
    "risks": "Remote code execution via unpatched CVEs.",
    "measures": "Upgrade Apache to latest stable version.",
    "epss": "0.15%",
    "cves": "CVE-2024-11111 (cvss: 9.1, epss: 0.03%)\nCVE-2024-22222 (cvss: 7.5, epss: 0.15%)\nCVE-2024-33333 (cvss: 5.0, epss: 0.01%)"
}

{
    "date": "2024-01-15T12:00:00.000Z",
    "risk": 3,
    "score": 0,
    "cvss": "",
    "ip": "192.0.2.5",
    "location": "http://example.com, https://example.com",
    "type": "web",
    "id": "Content-Security-Policy",
    "details": "CSP header missing across multiple endpoints",
    "uid": "eeee4444ffff5555aaaa0000bbbb1111cccc2222dddd3333eeee4444ffff5555",
    "link": "https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000005/host?ip=192.0.2.5",
    "falsepositive": "",
    "contact": "",
    "comment": "",
    "tags": "critical, patch-required, external",
    "problem": "Missing CSP header allows script injection.",
    "risks": "XSS attacks can steal sensitive user data.",
    "measures": "Implement strict Content-Security-Policy header.",
    "epss": "",
    "cves": ""
}

{
    "date": "2024-01-15T08:00:00.000Z",
    "risk": 1,
    "score": 0,
    "cvss": "",
    "ip": "192.0.2.1",
    "location": "192.0.2.1:53",
    "type": "network",
    "id": "53/tcp_domain",
    "details": "DNS server is publicly accessible",
    "uid": "aaaa0000bbbb1111cccc2222dddd3333eeee4444ffff5555aaaa0000bbbb1111",
    "link": "https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000001/host?ip=192.0.2.1",
    "falsepositive": "[fp]",
    "contact": "",
    "comment": "",
    "tags": "",
    "problem": "Open ports can expose services to unauthorized access.",
    "risks": "Attackers may exploit unprotected open ports.",
    "measures": "Close unused ports and apply firewall rules.",
    "epss": "",
    "cves": ""
}

{
    "date": "2024-01-15T09:00:00.000Z",
    "risk": 3,
    "score": -0.04,
    "cvss": "",
    "ip": "192.0.2.2",
    "location": "http://test.example.com, https://test.example.com",
    "type": "web",
    "id": "Content-Security-Policy",
    "details": "Content-Security-Policy header is missing",
    "uid": "bbbb1111cccc2222dddd3333eeee4444ffff5555aaaa0000bbbb1111cccc2222",
    "link": "https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000002/host?ip=192.0.2.2",
    "falsepositive": "",
    "contact": "",
    "comment": "",
    "tags": "",
    "problem": "Missing CSP allows attackers to inject malicious scripts.",
    "risks": "Script injection may lead to XSS and data theft.",
    "measures": "Add Content-Security-Policy headers to all HTTP responses.",
    "epss": "",
    "cves": ""
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
`Asset management`	External attack surface asset discovery and exposure monitoring per host
`DNS records`	DNS exposure and misconfiguration findings
`SSL/TLS certificates`	TLS/SSL configuration and certificate findings
`Network protocol analysis`	Open ports and network service exposure findings

In details, the following table denotes the type of events produced by this integration.

Name	Values
Kind	``
Category	``
Type	`info`

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

test_app_with_cves.jsontest_multiple_cves.jsontest_multiple_tags.jsontest_network_finding.jsontest_web_finding.json

{
    "message": "{\"date\":\"2024-01-15T10:00:00.000Z\",\"risk\":5,\"score\":0,\"cvss\":9.1,\"ip\":\"192.0.2.3\",\"location\":\"http://192.0.2.3, https://192.0.2.3\",\"type\":\"app_nested\",\"id\":\"Http Server\",\"details\":\"1 system with possibly patched vulnerability found\",\"uid\":\"cccc2222dddd3333eeee4444ffff5555aaaa0000bbbb1111cccc2222dddd3333\",\"link\":\"https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000003/host?ip=192.0.2.3\",\"falsepositive\":\"[fp]\",\"contact\":\"\",\"comment\":\"\",\"tags\":\"\",\"problem\":\"Outdated software may contain known exploits.\",\"risks\":\"Attackers can execute code remotely via known CVEs.\",\"measures\":\"Upgrade to the latest supported software version.\",\"epss\":\"0.03%\",\"cves\":\"CVE-2024-11111 (cvss: 9.1, epss: 0.03%)\"}",
    "event": {
        "action": "app_nested",
        "category": [
            "vulnerability"
        ],
        "reference": "https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000003/host?ip=192.0.2.3",
        "risk_score": 5,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2024-01-15T10:00:00Z",
    "host": {
        "ip": "192.0.2.3"
    },
    "locaterisk": {
        "cyberrisk_analysis": {
            "cves": [
                "CVE-2024-11111 (cvss: 9.1, epss: 0.03%)"
            ],
            "epss": 0.0003,
            "false_positive": true,
            "location": [
                "http://192.0.2.3",
                "https://192.0.2.3"
            ],
            "measures": "Upgrade to the latest supported software version.",
            "problem": "Outdated software may contain known exploits.",
            "risks": "Attackers can execute code remotely via known CVEs.",
            "scan_date": "2024-01-15T10:00:00Z",
            "score": 0.0
        }
    },
    "observer": {
        "product": "CyberRisk Analysis",
        "type": "scanner",
        "vendor": "LocateRisk"
    },
    "related": {
        "ip": [
            "192.0.2.3"
        ]
    },
    "vulnerability": {
        "description": "1 system with possibly patched vulnerability found",
        "id": "Http Server",
        "score": {
            "base": 9.1
        }
    }
}

{
    "message": "{\"date\":\"2024-01-15T11:00:00.000Z\",\"risk\":8,\"score\":0,\"cvss\":9.1,\"ip\":\"192.0.2.4\",\"location\":\"192.0.2.4:443\",\"type\":\"app_nested\",\"id\":\"Apache HTTP Server\",\"details\":\"3 systems with critical vulnerabilities found\",\"uid\":\"dddd3333eeee4444ffff5555aaaa0000bbbb1111cccc2222dddd3333eeee4444\",\"link\":\"https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000004/host?ip=192.0.2.4\",\"falsepositive\":\"\",\"contact\":\"\",\"comment\":\"\",\"tags\":\"\",\"problem\":\"Outdated Apache version with known exploits.\",\"risks\":\"Remote code execution via unpatched CVEs.\",\"measures\":\"Upgrade Apache to latest stable version.\",\"epss\":\"0.15%\",\"cves\":\"CVE-2024-11111 (cvss: 9.1, epss: 0.03%)\\nCVE-2024-22222 (cvss: 7.5, epss: 0.15%)\\nCVE-2024-33333 (cvss: 5.0, epss: 0.01%)\"}",
    "event": {
        "action": "app_nested",
        "category": [
            "vulnerability"
        ],
        "reference": "https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000004/host?ip=192.0.2.4",
        "risk_score": 8,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2024-01-15T11:00:00Z",
    "host": {
        "ip": "192.0.2.4"
    },
    "locaterisk": {
        "cyberrisk_analysis": {
            "cves": [
                "CVE-2024-11111 (cvss: 9.1, epss: 0.03%)",
                "CVE-2024-22222 (cvss: 7.5, epss: 0.15%)",
                "CVE-2024-33333 (cvss: 5.0, epss: 0.01%)"
            ],
            "epss": 0.0015,
            "location": [
                "192.0.2.4:443"
            ],
            "measures": "Upgrade Apache to latest stable version.",
            "problem": "Outdated Apache version with known exploits.",
            "risks": "Remote code execution via unpatched CVEs.",
            "scan_date": "2024-01-15T11:00:00Z",
            "score": 0.0
        }
    },
    "observer": {
        "product": "CyberRisk Analysis",
        "type": "scanner",
        "vendor": "LocateRisk"
    },
    "related": {
        "ip": [
            "192.0.2.4"
        ]
    },
    "vulnerability": {
        "description": "3 systems with critical vulnerabilities found",
        "id": "Apache HTTP Server",
        "score": {
            "base": 9.1
        }
    }
}

{
    "message": "{\"date\":\"2024-01-15T12:00:00.000Z\",\"risk\":3,\"score\":0,\"cvss\":\"\",\"ip\":\"192.0.2.5\",\"location\":\"http://example.com, https://example.com\",\"type\":\"web\",\"id\":\"Content-Security-Policy\",\"details\":\"CSP header missing across multiple endpoints\",\"uid\":\"eeee4444ffff5555aaaa0000bbbb1111cccc2222dddd3333eeee4444ffff5555\",\"link\":\"https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000005/host?ip=192.0.2.5\",\"falsepositive\":\"\",\"contact\":\"\",\"comment\":\"\",\"tags\":\"critical, patch-required, external\",\"problem\":\"Missing CSP header allows script injection.\",\"risks\":\"XSS attacks can steal sensitive user data.\",\"measures\":\"Implement strict Content-Security-Policy header.\",\"epss\":\"\",\"cves\":\"\"}",
    "event": {
        "action": "web",
        "category": [
            "vulnerability",
            "web"
        ],
        "reference": "https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000005/host?ip=192.0.2.5",
        "risk_score": 3,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2024-01-15T12:00:00Z",
    "host": {
        "ip": "192.0.2.5"
    },
    "locaterisk": {
        "cyberrisk_analysis": {
            "location": [
                "http://example.com",
                "https://example.com"
            ],
            "measures": "Implement strict Content-Security-Policy header.",
            "problem": "Missing CSP header allows script injection.",
            "risks": "XSS attacks can steal sensitive user data.",
            "scan_date": "2024-01-15T12:00:00Z",
            "score": 0.0,
            "tags": [
                "critical",
                "external",
                "patch-required"
            ]
        }
    },
    "observer": {
        "product": "CyberRisk Analysis",
        "type": "scanner",
        "vendor": "LocateRisk"
    },
    "related": {
        "ip": [
            "192.0.2.5"
        ]
    },
    "vulnerability": {
        "description": "CSP header missing across multiple endpoints",
        "id": "Content-Security-Policy"
    }
}

{
    "message": "{\"date\":\"2024-01-15T08:00:00.000Z\",\"risk\":1,\"score\":0,\"cvss\":\"\",\"ip\":\"192.0.2.1\",\"location\":\"192.0.2.1:53\",\"type\":\"network\",\"id\":\"53/tcp_domain\",\"details\":\"DNS server is publicly accessible\",\"uid\":\"aaaa0000bbbb1111cccc2222dddd3333eeee4444ffff5555aaaa0000bbbb1111\",\"link\":\"https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000001/host?ip=192.0.2.1\",\"falsepositive\":\"[fp]\",\"contact\":\"\",\"comment\":\"\",\"tags\":\"\",\"problem\":\"Open ports can expose services to unauthorized access.\",\"risks\":\"Attackers may exploit unprotected open ports.\",\"measures\":\"Close unused ports and apply firewall rules.\",\"epss\":\"\",\"cves\":\"\"}",
    "event": {
        "action": "network",
        "category": [
            "network",
            "vulnerability"
        ],
        "reference": "https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000001/host?ip=192.0.2.1",
        "risk_score": 1,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2024-01-15T08:00:00Z",
    "host": {
        "ip": "192.0.2.1"
    },
    "locaterisk": {
        "cyberrisk_analysis": {
            "false_positive": true,
            "location": [
                "192.0.2.1:53"
            ],
            "measures": "Close unused ports and apply firewall rules.",
            "problem": "Open ports can expose services to unauthorized access.",
            "risks": "Attackers may exploit unprotected open ports.",
            "scan_date": "2024-01-15T08:00:00Z",
            "score": 0.0
        }
    },
    "observer": {
        "product": "CyberRisk Analysis",
        "type": "scanner",
        "vendor": "LocateRisk"
    },
    "related": {
        "ip": [
            "192.0.2.1"
        ]
    },
    "vulnerability": {
        "description": "DNS server is publicly accessible",
        "id": "53/tcp_domain"
    }
}

{
    "message": "{\"date\":\"2024-01-15T09:00:00.000Z\",\"risk\":3,\"score\":-0.04,\"cvss\":\"\",\"ip\":\"192.0.2.2\",\"location\":\"http://test.example.com, https://test.example.com\",\"type\":\"web\",\"id\":\"Content-Security-Policy\",\"details\":\"Content-Security-Policy header is missing\",\"uid\":\"bbbb1111cccc2222dddd3333eeee4444ffff5555aaaa0000bbbb1111cccc2222\",\"link\":\"https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000002/host?ip=192.0.2.2\",\"falsepositive\":\"\",\"contact\":\"\",\"comment\":\"\",\"tags\":\"\",\"problem\":\"Missing CSP allows attackers to inject malicious scripts.\",\"risks\":\"Script injection may lead to XSS and data theft.\",\"measures\":\"Add Content-Security-Policy headers to all HTTP responses.\",\"epss\":\"\",\"cves\":\"\"}",
    "event": {
        "action": "web",
        "category": [
            "vulnerability",
            "web"
        ],
        "reference": "https://app.locaterisk.com/report/00000000-0000-0000-0000-000000000002/host?ip=192.0.2.2",
        "risk_score": 3,
        "type": [
            "info"
        ]
    },
    "@timestamp": "2024-01-15T09:00:00Z",
    "host": {
        "ip": "192.0.2.2"
    },
    "locaterisk": {
        "cyberrisk_analysis": {
            "location": [
                "http://test.example.com",
                "https://test.example.com"
            ],
            "measures": "Add Content-Security-Policy headers to all HTTP responses.",
            "problem": "Missing CSP allows attackers to inject malicious scripts.",
            "risks": "Script injection may lead to XSS and data theft.",
            "scan_date": "2024-01-15T09:00:00Z",
            "score": -0.04
        }
    },
    "observer": {
        "product": "CyberRisk Analysis",
        "type": "scanner",
        "vendor": "LocateRisk"
    },
    "related": {
        "ip": [
            "192.0.2.2"
        ]
    },
    "vulnerability": {
        "description": "Content-Security-Policy header is missing",
        "id": "Content-Security-Policy"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
`@timestamp`	`date`	Date/time when the event originated.
`event.action`	`keyword`	The action captured by the event.
`event.reference`	`keyword`	Event reference URL
`event.risk_score`	`float`	Risk score or priority of the event (e.g. security solutions). Use your system's original value here.
`event.type`	`keyword`	Event type. The third categorization field in the hierarchy.
`host.ip`	`ip`	Host ip addresses.
`locaterisk.cyberrisk_analysis.comment`	`keyword`	User-added comment for the finding
`locaterisk.cyberrisk_analysis.contact`	`keyword`	Contact information associated with the finding
`locaterisk.cyberrisk_analysis.cves`	`keyword`	List of associated CVE identifiers with CVSS and EPSS scores
`locaterisk.cyberrisk_analysis.epss`	`float`	Exploit Prediction Scoring System (EPSS) probability (0-1) for the finding
`locaterisk.cyberrisk_analysis.false_positive`	`boolean`	Indicates whether the finding has been marked as a false positive
`locaterisk.cyberrisk_analysis.location`	`keyword`	Scanned locations (URLs or host:port) associated with the finding
`locaterisk.cyberrisk_analysis.measures`	`keyword`	Recommended remediation measures to address the finding
`locaterisk.cyberrisk_analysis.problem`	`keyword`	Detailed description of the security problem associated with the finding
`locaterisk.cyberrisk_analysis.risks`	`keyword`	Description of the potential risks if the finding is not remediated
`locaterisk.cyberrisk_analysis.scan_date`	`datetime`	Represents the datetime of the scan by LocateRisk
`locaterisk.cyberrisk_analysis.score`	`float`	The risk score delta computed by LocateRisk for this finding
`locaterisk.cyberrisk_analysis.tags`	`keyword`	Tags associated with the finding
`observer.product`	`keyword`	The product name of the observer.
`observer.type`	`keyword`	The type of the observer the data is coming from.
`observer.vendor`	`keyword`	Vendor name of the observer.
`vulnerability.description`	`keyword`	Description of the vulnerability.
`vulnerability.id`	`keyword`	ID of the vulnerability.
`vulnerability.score.base`	`float`	Vulnerability Base score.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.