drewchurch/find-cve-in-security-content.py

## find-cve-in-security-content.py
from operator import truediv
import yaml, requests, json
from pathlib import Path
from argparse import ArgumentParser
import re

cisaUrl = 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json'
knownBadCVEs = []
parser = ArgumentParser()

parser.add_argument(
    "-i",
    "--cve-ids",
    default=None,
    nargs="+",
    help="Seek these CVE IDs in the ESCU repo.",
)

parser.add_argument(
    "-u",
    "--url",
    default=None,
    help="Find CVEs in this page"
)
args = parser.parse_args()

if args.cve_ids or args.url:
    if args.cve_ids:
        cveToFind = set(args.cve_ids)

    else:
        page = requests.get(args.url)
        if page.status_code == 200:
            cveList = re.findall("CVE-\\d{4}-\\d{4,7}",page.text)
            cveToFind = set(cveList)
    for c in cveToFind:
        knownBadCVEs.append({
            'cveId': c,
            'detection_found': "false"
        })

    print('cve,correlation_search_name')
    for detection in Path("security_content/detections/").rglob('*.yml'):
        with open (detection, 'r') as file:
            doc = yaml.load(file, Loader=yaml.FullLoader)
            if 'cve' in doc["tags"]:
                cvedict = doc["tags"]["cve"]
                name = "ESCU - " + doc["name"] + " - Rule"
                if len(cvedict) > 0:
                    for cve_detection in cvedict:
                        for c in knownBadCVEs:
                            if c['cveId'] == cve_detection:
                                c['detection_found'] = "true"
                                print(cve_detection + "," + name)

    cveWithNoDetection = filter(lambda c: c['detection_found'] == "false", knownBadCVEs)
    prettyList = []
    for i in list(cveWithNoDetection):
        prettyList.append(i['cveId'])
    print("{0} CVEs with no detection found:".format(len(prettyList)))
    print(prettyList)


else:
    response = requests.get(cisaUrl)
    if response.status_code == 200:

        jsonData = json.loads(response.text)
        for cve in jsonData['vulnerabilities']:
            knownBadCVEs.append({
                'cveId' : cve['cveID'],
                'dateAdded': cve['dateAdded']})
    print('cve,correlation_search_name,cisa_known_exploited,cisa_date_added')
    for detection in Path("security_content/detections/").rglob('*.yml'):
        with open (detection, 'r') as file:
            doc = yaml.load(file, Loader=yaml.FullLoader)
            if 'cve' in doc["tags"]:
                cvedict = doc["tags"]["cve"]
                name = "ESCU - " + doc["name"] + " - Rule"
                if len(cvedict) > 0:
                    for cve in cvedict:
                        for c in knownBadCVEs:
                            dateAdded = ""
                            knownBad = "false"
                            if c['cveId'] == cve:
                                knownBad = "true"
                                dateAdded = c['dateAdded']
                                break
                        print(cve + "," + name + "," + knownBad + "," + dateAdded)
	from operator import truediv
	import yaml, requests, json
	from pathlib import Path
	from argparse import ArgumentParser
	import re

	cisaUrl = 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json'
	knownBadCVEs = []
	parser = ArgumentParser()

	parser.add_argument(
	"-i",
	"--cve-ids",
	default=None,
	nargs="+",
	help="Seek these CVE IDs in the ESCU repo.",
	)

	parser.add_argument(
	"-u",
	"--url",
	default=None,
	help="Find CVEs in this page"
	)
	args = parser.parse_args()

	if args.cve_ids or args.url:
	if args.cve_ids:
	cveToFind = set(args.cve_ids)

	else:
	page = requests.get(args.url)
	if page.status_code == 200:
	cveList = re.findall("CVE-\\d{4}-\\d{4,7}",page.text)
	cveToFind = set(cveList)
	for c in cveToFind:
	knownBadCVEs.append({
	'cveId': c,
	'detection_found': "false"
	})

	print('cve,correlation_search_name')
	for detection in Path("security_content/detections/").rglob('*.yml'):
	with open (detection, 'r') as file:
	doc = yaml.load(file, Loader=yaml.FullLoader)
	if 'cve' in doc["tags"]:
	cvedict = doc["tags"]["cve"]
	name = "ESCU - " + doc["name"] + " - Rule"
	if len(cvedict) > 0:
	for cve_detection in cvedict:
	for c in knownBadCVEs:
	if c['cveId'] == cve_detection:
	c['detection_found'] = "true"
	print(cve_detection + "," + name)

	cveWithNoDetection = filter(lambda c: c['detection_found'] == "false", knownBadCVEs)
	prettyList = []
	for i in list(cveWithNoDetection):
	prettyList.append(i['cveId'])
	print("{0} CVEs with no detection found:".format(len(prettyList)))
	print(prettyList)


	else:
	response = requests.get(cisaUrl)
	if response.status_code == 200:

	jsonData = json.loads(response.text)
	for cve in jsonData['vulnerabilities']:
	knownBadCVEs.append({
	'cveId' : cve['cveID'],
	'dateAdded': cve['dateAdded']})
	print('cve,correlation_search_name,cisa_known_exploited,cisa_date_added')
	for detection in Path("security_content/detections/").rglob('*.yml'):
	with open (detection, 'r') as file:
	doc = yaml.load(file, Loader=yaml.FullLoader)
	if 'cve' in doc["tags"]:
	cvedict = doc["tags"]["cve"]
	name = "ESCU - " + doc["name"] + " - Rule"
	if len(cvedict) > 0:
	for cve in cvedict:
	for c in knownBadCVEs:
	dateAdded = ""
	knownBad = "false"
	if c['cveId'] == cve:
	knownBad = "true"
	dateAdded = c['dateAdded']
	break
	print(cve + "," + name + "," + knownBad + "," + dateAdded)