Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update find_hosts_by_cve.py #1195

Merged
merged 1 commit into from
Jul 2, 2024
Merged

Update find_hosts_by_cve.py #1195

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 39 additions & 6 deletions samples/spotlight/find_hosts_by_cve.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
"""Retrieve hosts by CVE vulnerability.

"""
______ __ _______ __ __ __
| |.----.-----.--.--.--.--| | __| |_.----.|__| |--.-----.
| ---|| _| _ | | | | _ |__ | _| _|| | <| -__|
Expand All @@ -23,6 +22,7 @@
"""
from argparse import ArgumentParser, RawTextHelpFormatter
import json
import sys
try:
from tabulate import tabulate
except ImportError as no_tabulate:
Expand Down Expand Up @@ -181,6 +181,15 @@ def parse_command_line() -> object:
'hostname, local_ip, os_version, service_provider, remediation)',
required=False
)
parser.add_argument(
'-i',
'--include',
help='List of columns to include in the display, comma-separated.\n'
'If specified, only these columns will be displayed.\n'
'(cve, score, severity, cve_description, created_on, updated_on,\n'
'hostname, local_ip, os_version, service_provider, remediation)',
required=False
)
parser.add_argument(
'-f',
'--format',
Expand Down Expand Up @@ -212,14 +221,21 @@ def parse_command_line() -> object:
action="store_false",
required=False
)
parser.add_argument(
'-d',
'--deduplicate',
help='Remove duplicate entries based on hostname and local_ip.',
action="store_true",
required=False
)

return parser.parse_args()


def inform(msg: str):
"""Provide informational updates to the user as the program progresses."""
if PROGRESS:
print(" %-80s" % msg, end="\r", flush=True) # pylint: disable=C0209
print(f"\r{' ' * 80}\r{msg}", end='', flush=True)


def get_spotlight_matches(cves: list) -> list:
Expand All @@ -237,6 +253,9 @@ def get_spotlight_matches(cves: list) -> list:

def remove_exclusions(resultset: dict) -> dict:
"""Remove requested columns from the table display."""
if INCLUDE:
return [{key: result[key] for key in INCLUDE} for result in resultset]

for result in resultset:
for exclusion in EXCLUDE:
del result[exclusion]
Expand All @@ -247,15 +266,23 @@ def remove_exclusions(resultset: dict) -> dict:
def get_match_details(match_list: list) -> list:
"""Retrieve details for individual matches to the specified CVEs."""
returned = []
seen = set()
inform("[ Retrieve matches ]")
match_results = spotlight.get_vulnerabilities(ids=match_list)
if match_results["status_code"] >= 400:
raise SystemExit(match_results["body"]["errors"][0]["message"])

for result in match_results["body"]["resources"]:
row = SpotlightCVEMatch(result).to_object()
inform(f"[ {row['cve']} ] Found {row['hostname']}/{row['local_ip']}")
returned.append(row)
if args.deduplicate:
unique_id = (row['hostname'], row['local_ip'])
if unique_id not in seen:
seen.add(unique_id)
inform(f"[ {row['cve']} ] Found {row['hostname']}/{row['local_ip']}")
returned.append(row)
else:
inform(f"[ {row['cve']} ] Found {row['hostname']}/{row['local_ip']}")
returned.append(row)

reversing = False
if SORT_REVERSE:
Expand Down Expand Up @@ -292,6 +319,10 @@ def get_match_details(match_list: list) -> list:
if args.exclude:
EXCLUDE = args.exclude.split(",")

INCLUDE = []
if args.include:
INCLUDE = args.include.split(",")

TABLE_FORMAT = "fancy_grid"
if args.format:
table_format = args.format.strip().lower()
Expand Down Expand Up @@ -338,8 +369,10 @@ def get_match_details(match_list: list) -> list:
inform("[ Process startup ]")
details = get_match_details(get_spotlight_matches(CVE_LIST))

# Clear the progress message
print("\r" + " " * 80 + "\r", end='', flush=True)

# Display results
inform("[ Results display ]")
print(
tabulate(
tabular_data=remove_exclusions(details),
Expand Down
Loading