check-msdefender 1.1.9__tar.gz → 1.1.11__tar.gz

{check_msdefender-1.1.9 → check_msdefender-1.1.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: check-msdefender
-Version: 1.1.9
+Version: 1.1.11
 Summary: A Nagios plugin for monitoring Microsoft Defender API endpoints
 Keywords: nagios,monitoring,microsoft,graph,api,azure
 Author-Email: ldvchosal <ldvchosal@github.com>
@@ -36,7 +36,7 @@ A comprehensive **Nagios plugin** for monitoring Microsoft Defender for Endpoint
 ## ✨ Features
 
 - 🔐 **Dual Authentication** - Support for Client Secret and Certificate-based authentication
-- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, alerts, and machine details
+- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, products with CVEs, alerts, and machine details
 - 📊 **Nagios Compatible** - Standard exit codes and performance data output
 - 🏗️ **Clean Architecture** - Modular design with testable components
 - 🔧 **Flexible Configuration** - File-based configuration with sensible defaults
@@ -68,6 +68,9 @@ check_msdefender lastseen -d machine.domain.tld -W 7 -C 30
 # Check vulnerabilities
 check_msdefender vulnerabilities -d machine.domain.tld -W 10 -C 100
 
+# Check products with CVE vulnerabilities
+check_msdefender products -d machine.domain.tld -W 5 -C 1
+
 # Check alerts
 check_msdefender alerts -d machine.domain.tld -W 1 -C 5
 
@@ -85,6 +88,7 @@ check_msdefender detail -d machine.domain.tld
 | `onboarding` | Check machine onboarding status | W:1, C:2 |
 | `lastseen` | Days since machine last seen | W:7, C:30 |
 | `vulnerabilities` | Vulnerability score calculation | W:10, C:100 |
+| `products` | Count of vulnerable software with CVEs | W:5, C:1 |
 | `alerts` | Count of unresolved alerts | W:1, C:0 |
 | `machines` | List all machines | W:10, C:25 |
 | `detail` | Get detailed machine information | - |
@@ -97,6 +101,15 @@ The vulnerability score is calculated as:
 - **Medium vulnerabilities** × 5
 - **Low vulnerabilities** × 1
 
+### Products CVE Monitoring
+
+The products command monitors installed software with known CVE vulnerabilities:
+- **Groups CVEs by software** (name, version, vendor)
+- **Shows CVE details** including severity levels and disk paths
+- **Counts vulnerable software** (not individual CVEs)
+- **Default thresholds**: Warning at 5 vulnerable software, Critical at 1
+- **Displays up to 10 software entries** with first 5 CVEs per software
+
 ### Alert Monitoring
 
 The alerts command monitors unresolved security alerts for a machine:
@@ -186,6 +199,11 @@ define command {
     command_line    $USER1$/check_msdefender/bin/check_msdefender vulnerabilities -d $HOSTALIAS$ -W 10 -C 100
 }
 
+define command {
+    command_name    check_defender_products
+    command_line    $USER1$/check_msdefender/bin/check_msdefender products -d $HOSTALIAS$ -W 5 -C 1
+}
+
 define command {
     command_name    check_defender_alerts
     command_line    $USER1$/check_msdefender/bin/check_msdefender alerts -d $HOSTALIAS$ -W 1 -C 5
@@ -217,6 +235,13 @@ define service {
     hostgroup_name          msdefender
 }
 
+define service {
+    use                     generic-service
+    service_description     DEFENDER_PRODUCTS
+    check_command           check_defender_products
+    hostgroup_name          msdefender
+}
+
 define service {
     use                     generic-service
     service_description     DEFENDER_ALERTS
@@ -236,6 +261,7 @@ check_msdefender/
 │   │   ├── onboarding.py      # Onboarding status command
 │   │   ├── lastseen.py        # Last seen command
 │   │   ├── vulnerabilities.py # Vulnerabilities command
+│   │   ├── products.py        # Products CVE monitoring command
 │   │   ├── alerts.py          # Alerts monitoring command
 │   │   ├── machines.py        # List machines command
 │   │   └── detail.py          # Machine detail command
@@ -252,6 +278,7 @@ check_msdefender/
 │   ├── onboarding_service.py  # Onboarding business logic
 │   ├── lastseen_service.py    # Last seen business logic
 │   ├── vulnerabilities_service.py # Vulnerability business logic
+│   ├── products_service.py    # Products CVE monitoring business logic
 │   ├── alerts_service.py      # Alerts monitoring business logic
 │   ├── machines_service.py    # Machines business logic
 │   ├── detail_service.py      # Detail business logic

{check_msdefender-1.1.9 → check_msdefender-1.1.11}/README.md

@@ -9,7 +9,7 @@ A comprehensive **Nagios plugin** for monitoring Microsoft Defender for Endpoint
 ## ✨ Features
 
 - 🔐 **Dual Authentication** - Support for Client Secret and Certificate-based authentication
-- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, alerts, and machine details
+- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, products with CVEs, alerts, and machine details
 - 📊 **Nagios Compatible** - Standard exit codes and performance data output
 - 🏗️ **Clean Architecture** - Modular design with testable components
 - 🔧 **Flexible Configuration** - File-based configuration with sensible defaults
@@ -41,6 +41,9 @@ check_msdefender lastseen -d machine.domain.tld -W 7 -C 30
 # Check vulnerabilities
 check_msdefender vulnerabilities -d machine.domain.tld -W 10 -C 100
 
+# Check products with CVE vulnerabilities
+check_msdefender products -d machine.domain.tld -W 5 -C 1
+
 # Check alerts
 check_msdefender alerts -d machine.domain.tld -W 1 -C 5
 
@@ -58,6 +61,7 @@ check_msdefender detail -d machine.domain.tld
 | `onboarding` | Check machine onboarding status | W:1, C:2 |
 | `lastseen` | Days since machine last seen | W:7, C:30 |
 | `vulnerabilities` | Vulnerability score calculation | W:10, C:100 |
+| `products` | Count of vulnerable software with CVEs | W:5, C:1 |
 | `alerts` | Count of unresolved alerts | W:1, C:0 |
 | `machines` | List all machines | W:10, C:25 |
 | `detail` | Get detailed machine information | - |
@@ -70,6 +74,15 @@ The vulnerability score is calculated as:
 - **Medium vulnerabilities** × 5
 - **Low vulnerabilities** × 1
 
+### Products CVE Monitoring
+
+The products command monitors installed software with known CVE vulnerabilities:
+- **Groups CVEs by software** (name, version, vendor)
+- **Shows CVE details** including severity levels and disk paths
+- **Counts vulnerable software** (not individual CVEs)
+- **Default thresholds**: Warning at 5 vulnerable software, Critical at 1
+- **Displays up to 10 software entries** with first 5 CVEs per software
+
 ### Alert Monitoring
 
 The alerts command monitors unresolved security alerts for a machine:
@@ -159,6 +172,11 @@ define command {
     command_line    $USER1$/check_msdefender/bin/check_msdefender vulnerabilities -d $HOSTALIAS$ -W 10 -C 100
 }
 
+define command {
+    command_name    check_defender_products
+    command_line    $USER1$/check_msdefender/bin/check_msdefender products -d $HOSTALIAS$ -W 5 -C 1
+}
+
 define command {
     command_name    check_defender_alerts
     command_line    $USER1$/check_msdefender/bin/check_msdefender alerts -d $HOSTALIAS$ -W 1 -C 5
@@ -190,6 +208,13 @@ define service {
     hostgroup_name          msdefender
 }
 
+define service {
+    use                     generic-service
+    service_description     DEFENDER_PRODUCTS
+    check_command           check_defender_products
+    hostgroup_name          msdefender
+}
+
 define service {
     use                     generic-service
     service_description     DEFENDER_ALERTS
@@ -209,6 +234,7 @@ check_msdefender/
 │   │   ├── onboarding.py      # Onboarding status command
 │   │   ├── lastseen.py        # Last seen command
 │   │   ├── vulnerabilities.py # Vulnerabilities command
+│   │   ├── products.py        # Products CVE monitoring command
 │   │   ├── alerts.py          # Alerts monitoring command
 │   │   ├── machines.py        # List machines command
 │   │   └── detail.py          # Machine detail command
@@ -225,6 +251,7 @@ check_msdefender/
 │   ├── onboarding_service.py  # Onboarding business logic
 │   ├── lastseen_service.py    # Last seen business logic
 │   ├── vulnerabilities_service.py # Vulnerability business logic
+│   ├── products_service.py    # Products CVE monitoring business logic
 │   ├── alerts_service.py      # Alerts monitoring business logic
 │   ├── machines_service.py    # Machines business logic
 │   ├── detail_service.py      # Detail business logic

{check_msdefender-1.1.9 → check_msdefender-1.1.11}/check_msdefender/__init__.py

@@ -1,4 +1,4 @@
 """Check Microsoft Defender API endpoints and check values - Nagios plugin."""
-__version__ = "1.1.9"
+__version__ = "1.1.11"
 __author__ = "ldvchosal"
 __email__ = "ldvchosa@github.com"

{check_msdefender-1.1.9 → check_msdefender-1.1.11}/check_msdefender/cli/commands/products.py

@@ -25,8 +25,12 @@ def register_products_commands(main_group: Any) -> None:
         critical: Optional[float],
     ) -> None:
         """Check installed products for Microsoft Defender."""
-        warning = warning if warning is not None else 5
-        critical = critical if critical is not None else 1
+        warning = (
+            warning if warning is not None else 1
+        )  # Trigger warning on any high/medium severity
+        critical = (
+            critical if critical is not None else 1
+        )  # Trigger critical on any critical severity
 
         try:
             # Load configuration

{check_msdefender-1.1.9 → check_msdefender-1.1.11}/check_msdefender/core/defender.py

@@ -65,10 +65,7 @@ class DefenderClient:
             "Content-Type": DefenderClient.application_json,
         }
 
-        params = {
-            PARAM_FILTER: f"computerDnsName eq '{dns_name}'",
-            PARAM_SELECT: "id"
-        }
+        params = {PARAM_FILTER: f"computerDnsName eq '{dns_name}'", PARAM_SELECT: "id"}
 
         try:
             start_time = time.time()

{check_msdefender-1.1.9 → check_msdefender-1.1.11}/check_msdefender/services/products_service.py

@@ -82,54 +82,85 @@ class ProductsService:
             )
             software_vulnerabilities[software_key]["severities"].add(severity)
 
-        # Count vulnerable software
-        vulnerable_software = []
+        # Count vulnerabilities by severity
+        critical_count = 0
+        high_count = 0
+        medium_count = 0
+        low_count = 0
 
+        for vulnerability in products:
+            severity = vulnerability.get("vulnerabilitySeverityLevel", "Unknown").lower()
+            if severity == "critical":
+                critical_count += 1
+            elif severity == "high":
+                high_count += 1
+            elif severity == "medium":
+                medium_count += 1
+            elif severity == "low":
+                low_count += 1
+
+        # Count vulnerable software for reporting
+        vulnerable_software = []
         for software in software_vulnerabilities.values():
             if len(software["cves"]) > 0:
                 vulnerable_software.append(software)
 
         # Create details for output
         details = []
+        total_score = 0
         if software_vulnerabilities:
-            summary_line = f"{len(products)} CVE found on {target_dns_name}"
+            summary_line = f"{len(products)} total CVEs (Critical: {critical_count}, High: {high_count}, Medium: {medium_count}, Low: {low_count}), {len(vulnerable_software)} vulnerable software"
             details.append(summary_line)
 
+            score = 0
             # Add software details (limit to 10)
             for software in list(software_vulnerabilities.values())[:10]:
                 cve_count = len(software["cves"])
                 unique_cves = list(set(software["cves"]))
                 cve_list = ", ".join(unique_cves[:5])  # Show first 5 CVEs
+                severities = ", ".join(software["severities"])  # Show first 5 CVEs
+                for severity_name in software["severities"]:
+                    severity = severity_name.lower()
+                    if severity == "critical":
+                        score += 100
+                    elif severity == "high":
+                        score += 10
+                    elif severity == "medium":
+                        score += 5
+                    elif severity == "low":
+                        score += 1
+
                 if len(unique_cves) > 5:
                     cve_list += f".. (+{len(unique_cves) - 5} more)"
 
                 details.append(
                     f"{software['name']} {software['version']} ({software['vendor']}) - "
-                    f"{cve_count} weaknesses ({cve_list})"
+                    f"{score} ({cve_count}: {severities}) weaknesses ({cve_list})"
                 )
-
+                total_score += score
                 # Add paths (limit to 4)
                 for path in list(software["paths"])[:4]:
                     details.append(f" - {path}")
 
         # Determine the value based on severity:
-        # - Vulnerable software triggers warnings
-        # - No vulnerabilities is OK
-        if vulnerable_software:
-            value = len(vulnerable_software)  # Will trigger warning threshold
-        else:
-            value = 0  # OK status
-
+        # - Critical vulnerabilities trigger critical threshold
+        # - High/Medium vulnerabilities trigger warning threshold
+        # - Low vulnerabilities or no vulnerabilities are OK
         result = {
-            "value": value,
+            "value": total_score,
             "details": details,
             "vulnerable_count": len(vulnerable_software),
+            "critical_count": critical_count,
+            "high_count": high_count,
+            "medium_count": medium_count,
+            "low_count": low_count,
             "total_cves": len(products),
             "total_software": len(software_vulnerabilities),
         }
 
         self.logger.info(
-            f"Products analysis complete: {len(products)} total CVEs, "
+            f"Products analysis complete: {len(products)} total CVEs "
+            f"(Critical: {critical_count}, High: {high_count}, Medium: {medium_count}, Low: {low_count}), "
             f"{len(vulnerable_software)} vulnerable software"
         )
         self.logger.method_exit("get_result", result)

{check_msdefender-1.1.9 → check_msdefender-1.1.11}/pyproject.toml

@@ -38,7 +38,7 @@ dependencies = [
     "azure-identity>=1.12.0",
     "click>=8.0,<9.0",
 ]
-version = "1.1.9"
+version = "1.1.11"
 
 [project.license]
 text = "MIT"