Assets - NVD Integration does not import vulnerabilities

[Przemysław Grzesiak]

I created importer using "Asset - NVD Integration" to import Vulnerabilities but unfortunately apart from End Point and Vulnerability Types no objects are imported, for every other "Entries in external source" in the result are equal to 0. I was trying with different start and end "Published range date" but to no effect. What may be the reason? Is NVD database empty?

NVD Integration Version: 2.0.4

Assets Version: 10.12.1-QR-0336

[Przemysław Grzesiak]

not relevant answer

[Marc - Devoteam]

HI @Przemysław Grzesiak 

Did you follow the instructions, did you request an API key from the NVD side?

Which JSM version are you running, if it's 11, you will need NVD version 3.

https://confluence.atlassian.com/servicemanagementserver/importing-nvd-data-into-assets-1528531084.html 

[Przemysław Grzesiak]

Did you follow the instructions, did you request an API key from the NVD side?

Yes, I entered API key.

Which JSM version are you running, if it's 11, you will need NVD version 3.

Jira Core 9.12.19 and JSM 5.12.19

[Marc - Devoteam]

Hi @Przemysław Grzesiak 

How did you set the Published Start Date, as format YYYY-MM-DD? This is mandatory.

Also there is no end date option.

[Przemysław Grzesiak]

I used several combinations, for example:

1. Start date: 1988-10-01, End Date 1990-01-01
2. Start date: 2025-01-01, End date EMPTY
3. Start date: 2025-07-01, End date EMPTY
4. Start date: 2025-09-01, End date EMPTY

Same result each time, End Point and Vulnerability Types are OK bot for other Object Types no entries found in External Source

[Marc - Devoteam]

Hi @Przemysław Grzesiak 

The only thing I can give you is to check the logs on what is happing when the import is done.

Logs should provide information.

It might be that the server running Jira can't reach the NVD source, firewall, etc, or any other blocking issues in your (company) network

[Przemysław Grzesiak]

Logs shows that for Vulnerability Type there are entities with empty Name which is set as Label in default config. Now I'm checking with different Label setting

[Przemysław Grzesiak]

Nothing special in logs:

2025-10-17 09:01:39,000 | http-nio-8080-exec-9 | 541x50346x1 | insight_import | njskra
============ Start import of module type insight-cve-import, importSourceId: 152, number of sequential steps: 6 at time 2025-10-17T07:01:39.000021355Z
2025-10-17 09:01:42,009 | http-nio-8080-exec-9 | 541x50346x1 | insight_import | njskra
Started import in new thread
2025-10-17 09:01:42,009 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Starting import with number of workers 8 at time 2025-10-17T09:01:42.009464037
2025-10-17 09:01:42,009 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Number of enabled ImportSourceOTs: 6
2025-10-17 09:01:42,009 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Number of matched enabled ImportSourceOTs: 1 for import configuration: CVE NVD Import
2025-10-17 09:01:42,009 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Number of enabled ImportSourceOTs: 6
2025-10-17 09:01:42,009 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Number of matched enabled ImportSourceOTs: 1 for import configuration: CVE NVD Import
2025-10-17 09:01:42,013 | insight-InsightImportThreadGroup-worker-thread-1 |  | insight_import | 
Started reading data for configured object type id 1016
2025-10-17 09:03:28,771 | insight-InsightImportThreadGroup-worker-thread-1 |  | insight_import | 
Completed reading data for configured object type id 1016 in 106758 ms
2025-10-17 09:03:28,771 | insight-InsightImportThreadGroup-worker-thread-1 |  | insight_import | 
Using memory backed import for import source object type 664
2025-10-17 09:03:28,771 | insight-InsightImportThreadGroup-worker-thread-1 |  | insight_import | 
Ended reading data for configured object type id 1016
2025-10-17 09:03:28,772 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Fetched all data locators from external source in 106759 ms
2025-10-17 09:03:28,782 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Mapped all data to internal objects in 0 ms
2025-10-17 09:03:28,788 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Decided actions for all objects in 0 ms
2025-10-17 09:03:28,788 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Objects to import 0
2025-10-17 09:03:28,797 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Starting handling of missing objects and post actions
2025-10-17 09:03:28,946 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Do post function for import source OT for object type 1016 at time 2025-10-17T09:03:28.946082855
2025-10-17 09:03:28,948 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Do post function for object schema: 13 at time 2025-10-17T09:03:28.948270018
2025-10-17 09:03:29,226 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
No outbound references to update
2025-10-17 09:03:29,226 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
Finished import at time 2025-10-17T09:03:29.226725724. Import took 107217 ms
2025-10-17 09:03:29,254 | insight-InsightThreadGroup-worker-thread-103 |  | insight_import | 
{"type":"IMPORT","id":null,"started":1760684502009,"ended":1760684609233,"executedType":"MANUAL","executedAsUserKey":"JIRAUSER67626","objectSchemaId":13,"numberOfWorkers":8,"result":"OK","status":"FINISHED","infoMessage":"No data to import","importSourceId":152,"moduleKey":"insight-cve-import","moduleVersion":1,"onlyExecutedForObjectTypes":[664],"objectTypeResultMap":{"1016":{"id":null,"objectTypeName":"Metric","objectTypeId":1016,"objectsUpdated":0,"objectsCreated":0,"objectsIdentical":0,"objectsMissingUpdated":0,"objectsMissingDeleted":0,"entriesInSource":0,"duplicateEntries":0,"emptyLabelEntries":0,"emptyExternalIdEntries":0,"objectsFilteredWithIQL":0,"errorMessages":[],"readExternalDataTimeInMs":106758,"mapExternalDataTimeInMs":0,"iqlFilteringTimeInMs":0,"decidingActionsTimeInMs":0,"writeInsightDataTimeInMs":0,"postFunctionTimeInMs":2,"executionTimeInMs":106760,"objectsWithUpdatedReferences":0}},"errorMessages":null,"updateReferencesTimeInMs":7,"inProgress":false,"ok":true}

[Marc - Devoteam]

Hi @Przemysław Grzesiak 

This seems strange that there is no info.

I think you would need to raise an issue with Atlassian Support

Hopefully they can provide an answer why there is no information imported.