check-msdefender 1.1.11__py3-none-any.whl → 1.1.14__py3-none-any.whl

check_msdefender/__init__.py

@@ -1,4 +1,4 @@
 """Check Microsoft Defender API endpoints and check values - Nagios plugin."""
-__version__ = "1.1.11"
+__version__ = "1.1.14"
 __author__ = "ldvchosal"
 __email__ = "ldvchosa@github.com"

check_msdefender/core/nagios.py

@@ -129,12 +129,9 @@ class NagiosPlugin:
                 DefenderSummary(details),
             )
 
-            # Set verbosity
-            check.verbosity = verbose
-
             # Run check and return exit code instead of exiting
             try:
-                check.main()
+                check.main(verbose=verbose)
                 return 0  # If main() doesn't exit, it's OK
             except SystemExit as e:
                 return int(e.code) if e.code is not None else 0

check_msdefender/services/products_service.py

@@ -7,6 +7,14 @@ from check_msdefender.core.exceptions import ValidationError
 from check_msdefender.core.logging_config import get_verbose_logger
 
 
+class DetailObject:
+    def __init__(self, software: str, data: str, score: int):
+        self.software = software
+        self.data = data
+        self.score = score
+        self.paths: list[str] = []
+
+
 class ProductsService:
     """Service for checking installed products on machines."""
 
@@ -49,7 +57,7 @@ class ProductsService:
             product for product in all_products if product.get("deviceId") == target_machine_id
         ]
 
-        self.logger.info(f"Found {len(products)} CVE vulnerabilities for machine {target_dns_name}")
+        self.logger.info(f"Found {len(products)} vulnerabilities for machine {target_dns_name}")
 
         # Group vulnerabilities by software
         software_vulnerabilities = {}
@@ -60,6 +68,7 @@ class ProductsService:
             cve_id = vulnerability.get("cveId", "Unknown")
             cvss_score = vulnerability.get("cvssScore", 0)
             disk_paths = vulnerability.get("diskPaths", [])
+            registry_paths = vulnerability.get("registryPaths", [])
             severity = vulnerability.get("vulnerabilitySeverityLevel", "Unknown")
 
             software_key = f"{software_name}-{software_version}-{software_vendor}"
@@ -71,16 +80,19 @@ class ProductsService:
                     "vendor": software_vendor,
                     "cves": [],
                     "paths": set(),
+                    "registryPaths": set(),
                     "max_cvss": 0,
-                    "severities": set(),
+                    "severities": [],
                 }
 
-            software_vulnerabilities[software_key]["cves"].append(cve_id)
+            cve_info = {"cve_id": cve_id, "severity": severity}
+            software_vulnerabilities[software_key]["cves"].append(cve_info)
             software_vulnerabilities[software_key]["paths"].update(disk_paths)
+            software_vulnerabilities[software_key]["registryPaths"].update(registry_paths)
             software_vulnerabilities[software_key]["max_cvss"] = max(
                 software_vulnerabilities[software_key]["max_cvss"], cvss_score
             )
-            software_vulnerabilities[software_key]["severities"].add(severity)
+            software_vulnerabilities[software_key]["severities"].append(severity)
 
         # Count vulnerabilities by severity
         critical_count = 0
@@ -109,18 +121,27 @@ class ProductsService:
         details = []
         total_score = 0
         if software_vulnerabilities:
-            summary_line = f"{len(products)} total CVEs (Critical: {critical_count}, High: {high_count}, Medium: {medium_count}, Low: {low_count}), {len(vulnerable_software)} vulnerable software"
-            details.append(summary_line)
 
-            score = 0
-            # Add software details (limit to 10)
-            for software in list(software_vulnerabilities.values())[:10]:
+            detail_objects = []
+
+            # Add software details
+            for software in list(software_vulnerabilities.values()):
+                score = 0
+                    
                 cve_count = len(software["cves"])
-                unique_cves = list(set(software["cves"]))
+                unique_cves = list(set(cve["cve_id"] for cve in software["cves"]))
                 cve_list = ", ".join(unique_cves[:5])  # Show first 5 CVEs
-                severities = ", ".join(software["severities"])  # Show first 5 CVEs
-                for severity_name in software["severities"]:
-                    severity = severity_name.lower()
+                severities = ""
+                # Count severities
+                severity_counts = {"Critical": 0, "High": 0, "Medium": 0, "Low": 0}
+                for sev in software["severities"]:
+                    severity_counts[sev] += 1
+                severities = ", ".join(
+                    f"{key}: {value}" for key, value in severity_counts.items() if value > 0
+                )
+
+                for cve in software["cves"]:
+                    severity = cve["severity"].lower()
                     if severity == "critical":
                         score += 100
                     elif severity == "high":
@@ -133,14 +154,47 @@ class ProductsService:
                 if len(unique_cves) > 5:
                     cve_list += f".. (+{len(unique_cves) - 5} more)"
 
-                details.append(
-                    f"{software['name']} {software['version']} ({software['vendor']}) - "
-                    f"{score} ({cve_count}: {severities}) weaknesses ({cve_list})"
+                detail_object = DetailObject(
+                    software=f"{software['name']} {software['version']} ({software['vendor']})",
+                    data=f"Score: {score}, CVEs: {cve_count} ({severities}), ({cve_list})",
+                    score=score,
                 )
+
                 total_score += score
+
                 # Add paths (limit to 4)
                 for path in list(software["paths"])[:4]:
-                    details.append(f" - {path}")
+                    detail_object.paths.append(f" - {path}")
+
+                # Indicate if more paths exist
+                if len(software["paths"]) > 4:
+                    detail_object.paths.append(f" - .. (+{len(software['paths']) - 4} more)")
+
+                # Add registry paths if available (limit to 4)
+                for registry_path in list(software["registryPaths"])[:4]:
+                    detail_object.paths.append(f" - {registry_path}")
+
+                # Indicate if more registry paths exist
+                if len(software["registryPaths"]) > 4:
+                    detail_object.paths.append(
+                        f" - .. (+{len(software['registryPaths']) - 4} more)"
+                    )
+
+                # Collect detail objects for sorting
+                detail_objects.append(detail_object)
+
+            summary_line = f"{len(vulnerable_software)} vulnerable products, score: {total_score}"
+            details.append(summary_line)
+            details.append("")
+
+            # Sort detail objects by score descending
+            detail_objects.sort(key=lambda x: x.score, reverse=True)
+
+            # Limit to top 10
+            for detail_object in detail_objects[:10]:
+                details.append(f"{detail_object.software} - {detail_object.data}")
+                details.extend(detail_object.paths)
+                details.append("")
 
         # Determine the value based on severity:
         # - Critical vulnerabilities trigger critical threshold
@@ -159,9 +213,7 @@ class ProductsService:
         }
 
         self.logger.info(
-            f"Products analysis complete: {len(products)} total CVEs "
-            f"(Critical: {critical_count}, High: {high_count}, Medium: {medium_count}, Low: {low_count}), "
-            f"{len(vulnerable_software)} vulnerable software"
+            f"Products analysis complete: {len(vulnerable_software)} vulnerable products, score: {total_score}"
         )
         self.logger.method_exit("get_result", result)
         return result

{check_msdefender-1.1.11.dist-info → check_msdefender-1.1.14.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: check-msdefender
-Version: 1.1.11
+Version: 1.1.14
 Summary: A Nagios plugin for monitoring Microsoft Defender API endpoints
 Keywords: nagios,monitoring,microsoft,graph,api,azure
 Author-Email: ldvchosal <ldvchosal@github.com>

{check_msdefender-1.1.11.dist-info → check_msdefender-1.1.14.dist-info}/RECORD

@@ -1,8 +1,8 @@
-check_msdefender-1.1.11.dist-info/METADATA,sha256=MHgcTdR_4DiCAjGildy8lZz6SA_aJDAjrFOJ3ALmhL8,14799
-check_msdefender-1.1.11.dist-info/WHEEL,sha256=9P2ygRxDrTJz3gsagc0Z96ukrxjr-LFBGOgv3AuKlCA,90
-check_msdefender-1.1.11.dist-info/entry_points.txt,sha256=OqVzHI1PaD9V22g0K7BhA2nYv4O-pH8mcLzuGdsk5rM,79
-check_msdefender-1.1.11.dist-info/licenses/LICENSE,sha256=kW3DwIsKc9HVYdS4f4tI6sLo-EPqBQbz-WmuvHU4Nak,1065
-check_msdefender/__init__.py,sha256=aslZRLikC8XahSmYabpKhejyLgruWcHT3l3WD7hSA_s,161
+check_msdefender-1.1.14.dist-info/METADATA,sha256=OSVniFKqRyyBelb0o-D6nkLRaKgrowYC8naoLfQ2B5Y,14799
+check_msdefender-1.1.14.dist-info/WHEEL,sha256=9P2ygRxDrTJz3gsagc0Z96ukrxjr-LFBGOgv3AuKlCA,90
+check_msdefender-1.1.14.dist-info/entry_points.txt,sha256=OqVzHI1PaD9V22g0K7BhA2nYv4O-pH8mcLzuGdsk5rM,79
+check_msdefender-1.1.14.dist-info/licenses/LICENSE,sha256=kW3DwIsKc9HVYdS4f4tI6sLo-EPqBQbz-WmuvHU4Nak,1065
+check_msdefender/__init__.py,sha256=owUTyFV_TJqmyYeGGjvGPOemYbiPQBJAxjnGR0xXlzw,161
 check_msdefender/__main__.py,sha256=TuNsRSdnkQm9OdBTAwD5aB2zV_Irc50WgylVWhrfnLY,124
 check_msdefender/check_msdefender.py,sha256=OO4Tg2DBW28AT-2LOH-qJM2pE5TPcF615BF7HjyZsmA,137
 check_msdefender/cli/__init__.py,sha256=NWaS5ZI9_252AcReugF_WGPMOvQ_B7sC_s3pSrGujcI,291
@@ -23,7 +23,7 @@ check_msdefender/core/config.py,sha256=IoWBL_DB110F4i6hFfli6iFDBXx57dHh32lCuLkcg
 check_msdefender/core/defender.py,sha256=JChnsyKD2grSMlxSDHEbTd4Al8pW-_8TAN8-1JsINR4,10389
 check_msdefender/core/exceptions.py,sha256=X4s_XM64SEVSs-4mGKqnF8xXwGFY3E0buvkgRNuCCX4,600
 check_msdefender/core/logging_config.py,sha256=Rd1F-IDXTx7yckrI8kyx2Ht20f5OcArPCAXb44BOmbg,4084
-check_msdefender/core/nagios.py,sha256=5GY4MIFOOB_bVSTbESxCpNVkJg1zzuuNna6rlwsECvQ,6312
+check_msdefender/core/nagios.py,sha256=BvO37EFaB3PnWbuYGVI5d85ICugQEy31G5wEtogheEs,6260
 check_msdefender/services/__init__.py,sha256=_fiKXxcz263IghXn9BnUWDKPgedhUPoSakEN3tBd2SU,44
 check_msdefender/services/alerts_service.py,sha256=poKZw1WKphmtPPnuMDrGRuPQbRLjLDZpo2rhFCh7TDc,4034
 check_msdefender/services/detail_service.py,sha256=tXfb6H2dhrTZ5y85H8W58GA8CvA-7aUwMIbNdcqECw0,3381
@@ -31,6 +31,6 @@ check_msdefender/services/lastseen_service.py,sha256=LiNVeUbAoMzowMvE90P7zCtKFHB
 check_msdefender/services/machines_service.py,sha256=KLRwltpYtwg_qtW6BGIxlH-PB9LcnEyW-i3C4RGSD30,3238
 check_msdefender/services/models.py,sha256=CDmQ5vU0-GawIalqXjXNk3rry6gsyjv6eSlW2NiXwQ0,979
 check_msdefender/services/onboarding_service.py,sha256=RIOsvALCoKV0YqnCHKYRkelSPrO-F-6vNBLlto4MpiI,2686
-check_msdefender/services/products_service.py,sha256=_hl8rEy2NJ6E4iPeRzGKJpNj6VosgF5F_kHOVAggXuc,7199
+check_msdefender/services/products_service.py,sha256=JzwAFb2aDW_-X83IQTdDhsa8CQD_s68gMGX298e2XWA,9060
 check_msdefender/services/vulnerabilities_service.py,sha256=LuRRQlFt-K82tGUhLCx_QCOp4CbBgSp7fktmeSSoa9o,6838
-check_msdefender-1.1.11.dist-info/RECORD,,
+check_msdefender-1.1.14.dist-info/RECORD,,