What's the best way to search for names of products (CPEs)?

Lets say I wanted Microsoft Word software objects CTI Butler.

Right now I can filter on vendor (e.g. m

FOR doc IN nvd_cpe_vertex_collection
  FILTER doc.vendor == "microsoft"
  RETURN [doc]

But I can’t see a specific product name field to further filter on, e.g. Word.

Is it possible to do this?

tl;dr yes.

Firstly, for context, the reason a name property does not exist is a design decision we made in cpe2stix (which generates these objects). That design decision was to keep to the standard STIX Software object properties.

For reference, here’s what a MSFT Word software object looks like:

  {
    "cpe": "cpe:2.3:a:microsoft:word:98:*:*:*:*:*:*:*",
    "id": "software--b17d242a-21c7-580e-a839-dca542323e61",
    "languages": [
      "en"
    ],
    "name": "Microsoft Word 98",
    "object_marking_refs": [
      "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
      "marking-definition--5e6fc5ec-e507-52e7-8465-cf5ffc47138a"
    ],
    "spec_version": "2.1",
    "swid": "C3CA4B85-2BB6-45F3-8CFD-8B4052F518CD",
    "type": "software",
    "vendor": "microsoft",
    "version": "98"
  }

If we know the exact product name, as we do in this instance (word) we can use a LIKE operator on the cpe key as follows;

FOR doc IN nvd_cpe_vertex_collection
  FILTER doc.cpe LIKE "cpe:2.3:a:microsoft:word:%"
  LET keys = ATTRIBUTES(doc)
  LET filteredKeys = keys[* FILTER !STARTS_WITH(CURRENT, "_")]
  RETURN KEEP(doc, filteredKeys)

For examples where you don’t know the full product name, you can make the search more open…

FOR doc IN nvd_cpe_vertex_collection
  FILTER doc.cpe LIKE "cpe:2.3:o:microsoft:windows_10_%"
  AND doc.version LIKE "10.0%"
  LET keys = ATTRIBUTES(doc)
  LET filteredKeys = keys[* FILTER !STARTS_WITH(CURRENT, "_")]
  RETURN KEEP(doc, filteredKeys)