Distribute CVE/IoC Files

To distribute CVE (Common Vulnerabilities and Exposures) /IoC (Indicators of Compromise) files, do the following:

Download the CVE/IoC bundle (available a zip file) from the Forescout Support Portal and copy it to the machine running the eyeInspect Content Distributor. An example path is shown below:
```
${HOME}/<file_name.zip>
```
Copy the CVE/IoC bundle to the content/cve-ioc-bundle folder of the eyeInspect Content Distributor using the following command:
```
./content-distributor-cli.sh import --type cve-ioc --path ${HOME}/<file_name.zip>
```
Run the eyeInspect Content Distributor.

Next, use one of the following three ways to distribute. Go here for more details about distribution commands.

Use the interactive distribute command

The interactive distribute command guides you through the process of distributing the bundle - simple select the content type, the content file, select the target Command Centers, and confirm the distribution. The bash commands below illustrate this:

eyeinspect:> distribute
? Select content type to distribute: CVE_IOC_BUNDLE
? Select content file to be distributed: <file_name.zip>
? Select Command Centers: <CC_IP_Address>
? Given content will be distributed to all sensors connected to selected Command Centers. Do you confirm? true
File distribution was successful for all selected Command Centers.
Refer to the log file for more details: <file_name.csv>

Use the distribute command with parameters

It is possible to distribute the CVE/IoC bundle using the distribute command with parameters, as seen below.

eyeinspect:> distribute with-params CVE_IOC_BUNDLE <file_name.zip> <CC_IP_Address>
File distribution was successful for all selected Command Centers.
Refer to the log file for more details: <file_name.csv>

Use an existing template to distribute

To create a template for future distributions, use the interactive template create command, and enter the relevant information, as seen below.

eyeinspect:> template create
? Select content type to distribute: CVE_IOC_BUNDLE
? Select content file to be distributed: <file_name.zip>
? Select Command Centers: <CC_IP_Address>
? Input task template name:  cve
The content distribution task template is saved to the file <file_name.json>.
The sensor list can be modified and the distribution task can be initiated by calling `distribute from-template <file_name>.json`

All sensors of the target Command Center are listed in the template file. The target sensors for the distribution can be changed by editing this file:

sudo chown -R $(whoami):$(whoami) ${HOME}/content-distributor-cli-base/export
sudo chmod -R o+w ${HOME}/content-distributor-cli-base/export
nano ${HOME}/content-distributor-cli-base/export/template/<file-name>.json

Enter the name of the template and the CVE/IoC file to distribute using an existing template, as seen below:

eyeinspect:> distribute from-template <file_name_.json> <file_name.zip>
File distribution was successful for all selected Command Centers.
Refer to the log file for more details: <file_name.csv>