souleyez 2.43.26__py3-none-any.whl → 2.43.34__py3-none-any.whl

souleyez/ui/splunk_gap_analysis_view.py

@@ -18,27 +18,28 @@ console = Console()
 
 # Severity colors
 SEVERITY_COLORS = {
-    'Critical': 'red',
-    'High': 'yellow',
-    'Medium': 'white',
-    'Low': 'bright_black',
-    'critical': 'red',
-    'high': 'yellow',
-    'medium': 'white',
-    'low': 'bright_black'
+    "Critical": "red",
+    "High": "yellow",
+    "Medium": "white",
+    "Low": "bright_black",
+    "critical": "red",
+    "high": "yellow",
+    "medium": "white",
+    "low": "bright_black",
 }
 
 SEVERITY_ICONS = {
-    'Critical': '[red bold]C[/red bold]',
-    'High': '[yellow bold]H[/yellow bold]',
-    'Medium': '[white]M[/white]',
-    'Low': '[bright_black]L[/bright_black]'
+    "Critical": "[red bold]C[/red bold]",
+    "High": "[yellow bold]H[/yellow bold]",
+    "Medium": "[white]M[/white]",
+    "Low": "[bright_black]L[/bright_black]",
 }
 
 
 @dataclass
 class SplunkVulnGap:
     """Represents a vulnerability gap between detection sources."""
+
     cve_id: str
     severity: str
     host_ip: str
@@ -52,6 +53,7 @@ class SplunkVulnGap:
 @dataclass
 class SplunkGapResult:
     """Result of Splunk gap analysis."""
+
     splunk_total: int = 0
     scan_total: int = 0
     splunk_only: List[SplunkVulnGap] = field(default_factory=list)
@@ -60,7 +62,9 @@ class SplunkGapResult:
     coverage_pct: float = 0.0
 
 
-def show_splunk_gap_analysis_view(engagement_id: int, engagement_name: str = "") -> None:
+def show_splunk_gap_analysis_view(
+    engagement_id: int, engagement_name: str = ""
+) -> None:
     """
     Display Splunk gap analysis view.
 
@@ -76,17 +80,36 @@ def show_splunk_gap_analysis_view(engagement_id: int, engagement_name: str = "")
 
         # Header
         click.echo("\n┌" + "─" * (width - 2) + "┐")
-        click.echo("│" + click.style(" SPLUNK GAP ANALYSIS ".center(width - 2), bold=True, fg='cyan') + "│")
+        click.echo(
+            "│"
+            + click.style(
+                " SPLUNK GAP ANALYSIS ".center(width - 2), bold=True, fg="cyan"
+            )
+            + "│"
+        )
         click.echo("└" + "─" * (width - 2) + "┘")
         click.echo()
-        click.echo(click.style("  Compare Splunk (passive/synced) vs Scan (active) findings", fg='bright_black'))
+        click.echo(
+            click.style(
+                "  Compare Splunk (passive/synced) vs Scan (active) findings",
+                fg="bright_black",
+            )
+        )
         click.echo()
 
         # Check if Splunk is configured
         config = WazuhConfig.get_config(engagement_id)
 
-        if not config or config.get('siem_type') != 'splunk' or not config.get('enabled'):
-            click.echo(click.style("  Splunk is not configured for this engagement.", fg='yellow'))
+        if (
+            not config
+            or config.get("siem_type") != "splunk"
+            or not config.get("enabled")
+        ):
+            click.echo(
+                click.style(
+                    "  Splunk is not configured for this engagement.", fg="yellow"
+                )
+            )
             click.echo()
             click.echo("  Configure Splunk in Settings -> SIEM Integration")
             click.echo()
@@ -95,7 +118,7 @@ def show_splunk_gap_analysis_view(engagement_id: int, engagement_name: str = "")
             click.echo("  [q] Back")
             click.echo()
             try:
-                if click.getchar().lower() == 'q':
+                if click.getchar().lower() == "q":
                     return
             except (KeyboardInterrupt, EOFError):
                 return
@@ -104,20 +127,23 @@ def show_splunk_gap_analysis_view(engagement_id: int, engagement_name: str = "")
         # Get Splunk client and run analysis
         try:
             from souleyez.integrations.siem.splunk import SplunkSIEMClient
-            client = SplunkSIEMClient.from_config({
-                'api_url': config.get('api_url', ''),
-                'username': config.get('username', ''),
-                'password': config.get('password', ''),
-                'verify_ssl': config.get('verify_ssl', False),
-                'default_index': config.get('default_index', 'main'),
-            })
+
+            client = SplunkSIEMClient.from_config(
+                {
+                    "api_url": config.get("api_url", ""),
+                    "username": config.get("username", ""),
+                    "password": config.get("password", ""),
+                    "verify_ssl": config.get("verify_ssl", False),
+                    "default_index": config.get("default_index", "main"),
+                }
+            )
 
             # Run gap analysis
             result = _analyze_gaps(engagement_id, client)
             stats = _get_coverage_stats(result)
 
         except Exception as e:
-            click.echo(click.style(f"  Error connecting to Splunk: {e}", fg='red'))
+            click.echo(click.style(f"  Error connecting to Splunk: {e}", fg="red"))
             click.echo()
             click.echo("  Make sure the wazuh_vulns index exists and has data.")
             click.echo("  Run: python3 scripts/wazuh_vuln_to_splunk.py --all")
@@ -142,17 +168,17 @@ def show_splunk_gap_analysis_view(engagement_id: int, engagement_name: str = "")
         try:
             choice = input("  Select option: ").strip().lower()
 
-            if choice == 'q':
+            if choice == "q":
                 return
-            elif choice == '1':
+            elif choice == "1":
                 _show_splunk_only(result, width)
-            elif choice == '2':
+            elif choice == "2":
                 _show_scan_only(result, width)
-            elif choice == '3':
+            elif choice == "3":
                 _show_confirmed(result, width)
-            elif choice == 'a':
+            elif choice == "a":
                 _show_actionable_gaps(result, width)
-            elif choice == 'r':
+            elif choice == "r":
                 continue  # Refresh
         except (KeyboardInterrupt, EOFError):
             return
@@ -179,13 +205,13 @@ def _analyze_gaps(engagement_id: int, client) -> SplunkGapResult:
     # Group by CVE ID to find matches
     splunk_by_cve: Dict[str, List[Dict]] = {}
     for v in splunk_vulns:
-        cve = v.get('cve_id')
+        cve = v.get("cve_id")
         if cve:
             splunk_by_cve.setdefault(cve, []).append(v)
 
     scan_by_cve: Dict[str, List[Dict]] = {}
     for f in scan_findings:
-        cve = f.get('cve_id')
+        cve = f.get("cve_id")
         if cve:
             scan_by_cve.setdefault(cve, []).append(f)
 
@@ -202,16 +228,18 @@ def _analyze_gaps(engagement_id: int, client) -> SplunkGapResult:
         splunk_v = splunk_entries[0]
         scan_f = scan_entries[0]
 
-        result.confirmed.append(SplunkVulnGap(
-            cve_id=cve_id,
-            severity=splunk_v.get('severity', 'Medium'),
-            host_ip=f"{splunk_v.get('host_ip', '-')} / {scan_f.get('host_ip', '-')}",
-            source='both',
-            splunk_details=splunk_v,
-            scan_details=scan_f,
-            recommendation=f"Confirmed by both sources ({len(splunk_entries)} Splunk, {len(scan_entries)} scan)",
-            confidence='high'
-        ))
+        result.confirmed.append(
+            SplunkVulnGap(
+                cve_id=cve_id,
+                severity=splunk_v.get("severity", "Medium"),
+                host_ip=f"{splunk_v.get('host_ip', '-')} / {scan_f.get('host_ip', '-')}",
+                source="both",
+                splunk_details=splunk_v,
+                scan_details=scan_f,
+                recommendation=f"Confirmed by both sources ({len(splunk_entries)} Splunk, {len(scan_entries)} scan)",
+                confidence="high",
+            )
+        )
 
     # Find Splunk-only CVEs (scan didn't find this CVE anywhere)
     splunk_only_cves = all_splunk_cves - all_scan_cves
@@ -219,15 +247,17 @@ def _analyze_gaps(engagement_id: int, client) -> SplunkGapResult:
         splunk_entries = splunk_by_cve[cve_id]
         splunk_v = splunk_entries[0]
 
-        result.splunk_only.append(SplunkVulnGap(
-            cve_id=cve_id,
-            severity=splunk_v.get('severity', 'Medium'),
-            host_ip=splunk_v.get('host_ip', '-'),
-            source='splunk',
-            splunk_details=splunk_v,
-            recommendation="Package-level vulnerability - network scans typically can't detect",
-            confidence='medium'
-        ))
+        result.splunk_only.append(
+            SplunkVulnGap(
+                cve_id=cve_id,
+                severity=splunk_v.get("severity", "Medium"),
+                host_ip=splunk_v.get("host_ip", "-"),
+                source="splunk",
+                splunk_details=splunk_v,
+                recommendation="Package-level vulnerability - network scans typically can't detect",
+                confidence="medium",
+            )
+        )
 
     # Find Scan-only CVEs (Splunk/Wazuh didn't detect this CVE)
     scan_only_cves = all_scan_cves - all_splunk_cves
@@ -235,15 +265,17 @@ def _analyze_gaps(engagement_id: int, client) -> SplunkGapResult:
         scan_entries = scan_by_cve[cve_id]
         scan_f = scan_entries[0]
 
-        result.scan_only.append(SplunkVulnGap(
-            cve_id=cve_id,
-            severity=scan_f.get('severity', 'Medium'),
-            host_ip=scan_f.get('host_ip', '-'),
-            source='scan',
-            scan_details=scan_f,
-            recommendation="Network-exposed CVE - Wazuh agent may not be installed on this host",
-            confidence='medium'
-        ))
+        result.scan_only.append(
+            SplunkVulnGap(
+                cve_id=cve_id,
+                severity=scan_f.get("severity", "Medium"),
+                host_ip=scan_f.get("host_ip", "-"),
+                source="scan",
+                scan_details=scan_f,
+                recommendation="Network-exposed CVE - Wazuh agent may not be installed on this host",
+                confidence="medium",
+            )
+        )
 
     # Calculate coverage based on unique CVEs
     total_unique_cves = len(all_splunk_cves | all_scan_cves)
@@ -262,41 +294,45 @@ def _get_splunk_cves(client) -> List[Dict[str, Any]]:
         result = []
         for v in vulns:
             # Map agent_name to host_ip if available
-            host_ip = v.get('agent_ip') or v.get('agent_name', '-')
+            host_ip = v.get("agent_ip") or v.get("agent_name", "-")
             # Normalize CVE ID to uppercase for matching
-            cve_id = v.get('cve_id', '')
+            cve_id = v.get("cve_id", "")
             if cve_id:
                 cve_id = cve_id.upper()
-            result.append({
-                'cve_id': cve_id,
-                'severity': v.get('severity', 'Medium'),
-                'host_ip': host_ip,
-                'package_name': v.get('package_name'),
-                'package_version': v.get('package_version'),
-                'cvss_score': v.get('cvss_score'),
-                'agent_name': v.get('agent_name'),
-                'os_name': v.get('os_name')
-            })
+            result.append(
+                {
+                    "cve_id": cve_id,
+                    "severity": v.get("severity", "Medium"),
+                    "host_ip": host_ip,
+                    "package_name": v.get("package_name"),
+                    "package_version": v.get("package_version"),
+                    "cvss_score": v.get("cvss_score"),
+                    "agent_name": v.get("agent_name"),
+                    "os_name": v.get("os_name"),
+                }
+            )
         return result
     except Exception as e:
-        click.echo(click.style(f"  Warning: Error fetching Splunk vulns: {e}", fg='yellow'))
+        click.echo(
+            click.style(f"  Warning: Error fetching Splunk vulns: {e}", fg="yellow")
+        )
         return []
 
 
 def _get_scan_cves(engagement_id: int) -> List[Dict[str, Any]]:
     """Get CVE findings from active scans."""
     import re
+
     db = get_db()
-    cve_pattern = re.compile(r'CVE-\d{4}-\d+', re.IGNORECASE)
+    cve_pattern = re.compile(r"CVE-\d{4}-\d+", re.IGNORECASE)
     result = []
 
     # Get hosts for this engagement
     hosts = db.execute(
-        "SELECT id, ip_address FROM hosts WHERE engagement_id = ?",
-        (engagement_id,)
+        "SELECT id, ip_address FROM hosts WHERE engagement_id = ?", (engagement_id,)
     )
 
-    host_map = {h['id']: h['ip_address'] for h in hosts}
+    host_map = {h["id"]: h["ip_address"] for h in hosts}
 
     if not host_map:
         return []
@@ -304,58 +340,65 @@ def _get_scan_cves(engagement_id: int) -> List[Dict[str, Any]]:
     # 1. Get nuclei_findings with CVE IDs (they have cve_id column)
     nuclei_findings = db.execute(
         "SELECT * FROM nuclei_findings WHERE engagement_id = ? AND cve_id IS NOT NULL",
-        (engagement_id,)
+        (engagement_id,),
     )
 
     for f in nuclei_findings:
-        cve_id = f.get('cve_id')
+        cve_id = f.get("cve_id")
         if cve_id:
             # Extract host IP from matched_at if available
-            matched_at = f.get('matched_at', '')
+            matched_at = f.get("matched_at", "")
             host_ip = None
             # Try to extract IP from matched_at URL
-            ip_match = re.search(r'(\d+\.\d+\.\d+\.\d+)', matched_at)
+            ip_match = re.search(r"(\d+\.\d+\.\d+\.\d+)", matched_at)
             if ip_match:
                 host_ip = ip_match.group(1)
 
-            result.append({
-                'cve_id': cve_id.upper(),
-                'host_ip': host_ip or '-',
-                'severity': (f.get('severity') or 'Medium').title(),
-                'title': f.get('name'),
-                'tool': 'nuclei',
-                'port': None,
-                'service': None
-            })
+            result.append(
+                {
+                    "cve_id": cve_id.upper(),
+                    "host_ip": host_ip or "-",
+                    "severity": (f.get("severity") or "Medium").title(),
+                    "title": f.get("name"),
+                    "tool": "nuclei",
+                    "port": None,
+                    "service": None,
+                }
+            )
 
     # 2. Get regular findings and extract CVEs from title/refs
     host_ids = list(host_map.keys())
-    placeholders = ','.join('?' * len(host_ids))
-    findings = db.execute(f"""
+    placeholders = ",".join("?" * len(host_ids))
+    findings = db.execute(
+        f"""
         SELECT f.*, h.ip_address
         FROM findings f
         JOIN hosts h ON f.host_id = h.id
         WHERE f.host_id IN ({placeholders})
         AND (f.title LIKE '%CVE-%' OR f.refs LIKE '%CVE-%')
-    """, tuple(host_ids))
+    """,
+        tuple(host_ids),
+    )
 
     for f in findings:
         # Try to extract CVE from title
-        title = f.get('title', '') or ''
-        refs = f.get('refs', '') or ''
-        combined = title + ' ' + refs
+        title = f.get("title", "") or ""
+        refs = f.get("refs", "") or ""
+        combined = title + " " + refs
 
         matches = cve_pattern.findall(combined)
         for cve_id in matches:
-            result.append({
-                'cve_id': cve_id.upper(),
-                'host_ip': f.get('ip_address'),
-                'severity': (f.get('severity') or 'Medium').title(),
-                'title': f.get('title'),
-                'tool': f.get('tool'),
-                'port': f.get('port'),
-                'service': None
-            })
+            result.append(
+                {
+                    "cve_id": cve_id.upper(),
+                    "host_ip": f.get("ip_address"),
+                    "severity": (f.get("severity") or "Medium").title(),
+                    "title": f.get("title"),
+                    "tool": f.get("tool"),
+                    "port": f.get("port"),
+                    "service": None,
+                }
+            )
 
     return result
 
@@ -363,26 +406,28 @@ def _get_scan_cves(engagement_id: int) -> List[Dict[str, Any]]:
 def _get_coverage_stats(result: SplunkGapResult) -> Dict[str, Any]:
     """Calculate coverage statistics."""
     stats = {
-        'coverage_pct': result.coverage_pct,
-        'by_severity': {
-            'splunk_only': {},
-            'scan_only': {},
-            'confirmed': {}
-        }
+        "coverage_pct": result.coverage_pct,
+        "by_severity": {"splunk_only": {}, "scan_only": {}, "confirmed": {}},
     }
 
     # Count by severity
     for gap in result.splunk_only:
         sev = gap.severity
-        stats['by_severity']['splunk_only'][sev] = stats['by_severity']['splunk_only'].get(sev, 0) + 1
+        stats["by_severity"]["splunk_only"][sev] = (
+            stats["by_severity"]["splunk_only"].get(sev, 0) + 1
+        )
 
     for gap in result.scan_only:
         sev = gap.severity
-        stats['by_severity']['scan_only'][sev] = stats['by_severity']['scan_only'].get(sev, 0) + 1
+        stats["by_severity"]["scan_only"][sev] = (
+            stats["by_severity"]["scan_only"].get(sev, 0) + 1
+        )
 
     for gap in result.confirmed:
         sev = gap.severity
-        stats['by_severity']['confirmed'][sev] = stats['by_severity']['confirmed'].get(sev, 0) + 1
+        stats["by_severity"]["confirmed"][sev] = (
+            stats["by_severity"]["confirmed"].get(sev, 0) + 1
+        )
 
     return stats
 
@@ -394,48 +439,73 @@ def _render_summary_dashboard(result: SplunkGapResult, stats: Dict, width: int)
     confirmed = len(result.confirmed)
     splunk_only = len(result.splunk_only)
     scan_only = len(result.scan_only)
-    coverage = stats.get('coverage_pct', 0)
+    coverage = stats.get("coverage_pct", 0)
 
     # Coverage color
     if coverage >= 80:
-        coverage_color = 'green'
+        coverage_color = "green"
     elif coverage >= 50:
-        coverage_color = 'yellow'
+        coverage_color = "yellow"
     else:
-        coverage_color = 'red'
+        coverage_color = "red"
 
     # Detection Sources
     click.echo(click.style("  DETECTION SOURCES", bold=True))
-    click.echo(f"    Splunk (passive):  {click.style(str(splunk_total), fg='cyan', bold=True)} CVEs")
-    click.echo(f"    Scans (active):    {click.style(str(scan_total), fg='cyan', bold=True)} CVEs")
+    click.echo(
+        f"    Splunk (passive):  {click.style(str(splunk_total), fg='cyan', bold=True)} CVEs"
+    )
+    click.echo(
+        f"    Scans (active):    {click.style(str(scan_total), fg='cyan', bold=True)} CVEs"
+    )
     click.echo()
 
     # Analysis Results
     click.echo(click.style("  ANALYSIS RESULTS", bold=True))
-    click.echo(f"    ✓ Confirmed (both):     {click.style(str(confirmed), fg='green', bold=True)}")
-    click.echo(f"    ⚠ Splunk Only:          {click.style(str(splunk_only), fg='yellow', bold=True)}  <- Scans missed these")
-    click.echo(f"    ◐ Scan Only:            {click.style(str(scan_only), fg='blue', bold=True)}  <- Splunk missed these")
+    click.echo(
+        f"    ✓ Confirmed (both):     {click.style(str(confirmed), fg='green', bold=True)}"
+    )
+    click.echo(
+        f"    ⚠ Splunk Only:          {click.style(str(splunk_only), fg='yellow', bold=True)}  <- Scans missed these"
+    )
+    click.echo(
+        f"    ◐ Scan Only:            {click.style(str(scan_only), fg='blue', bold=True)}  <- Splunk missed these"
+    )
     click.echo()
 
     # Coverage
-    click.echo(f"  Coverage: " + click.style(f"{coverage:.1f}%", fg=coverage_color, bold=True) +
-              " of Splunk vulns confirmed by scans")
+    click.echo(
+        f"  Coverage: "
+        + click.style(f"{coverage:.1f}%", fg=coverage_color, bold=True)
+        + " of Splunk vulns confirmed by scans"
+    )
     click.echo()
 
     # Add explanation note for low coverage
     if coverage < 20:
-        click.echo(click.style("  NOTE: ", fg='cyan', bold=True) +
-                  click.style("Low overlap is expected. Splunk/Wazuh detects ", fg='bright_black') +
-                  click.style("package-level", fg='cyan') +
-                  click.style(" vulns", fg='bright_black'))
-        click.echo(click.style("        (installed software), while scans find ", fg='bright_black') +
-                  click.style("network-exposed", fg='cyan') +
-                  click.style(" vulns (services).", fg='bright_black'))
+        click.echo(
+            click.style("  NOTE: ", fg="cyan", bold=True)
+            + click.style(
+                "Low overlap is expected. Splunk/Wazuh detects ", fg="bright_black"
+            )
+            + click.style("package-level", fg="cyan")
+            + click.style(" vulns", fg="bright_black")
+        )
+        click.echo(
+            click.style(
+                "        (installed software), while scans find ", fg="bright_black"
+            )
+            + click.style("network-exposed", fg="cyan")
+            + click.style(" vulns (services).", fg="bright_black")
+        )
         click.echo()
 
     # Severity breakdown
-    sev_breakdown = stats.get('by_severity', {})
-    if sev_breakdown.get('splunk_only') or sev_breakdown.get('scan_only') or sev_breakdown.get('confirmed'):
+    sev_breakdown = stats.get("by_severity", {})
+    if (
+        sev_breakdown.get("splunk_only")
+        or sev_breakdown.get("scan_only")
+        or sev_breakdown.get("confirmed")
+    ):
         _render_severity_breakdown(sev_breakdown, width)
 
 
@@ -446,7 +516,7 @@ def _render_severity_breakdown(breakdown: Dict, width: int) -> None:
         header_style="bold",
         box=box.SIMPLE,
         padding=(0, 2),
-        expand=False
+        expand=False,
     )
 
     table.add_column("Severity", width=14)
@@ -454,17 +524,17 @@ def _render_severity_breakdown(breakdown: Dict, width: int) -> None:
     table.add_column("Scan Only", width=12, justify="right")
     table.add_column("Confirmed", width=12, justify="right")
 
-    for sev in ['Critical', 'High', 'Medium', 'Low']:
-        color = SEVERITY_COLORS.get(sev, 'white')
-        splunk_only = breakdown.get('splunk_only', {}).get(sev, 0)
-        scan_only = breakdown.get('scan_only', {}).get(sev, 0)
-        confirmed = breakdown.get('confirmed', {}).get(sev, 0)
+    for sev in ["Critical", "High", "Medium", "Low"]:
+        color = SEVERITY_COLORS.get(sev, "white")
+        splunk_only = breakdown.get("splunk_only", {}).get(sev, 0)
+        scan_only = breakdown.get("scan_only", {}).get(sev, 0)
+        confirmed = breakdown.get("confirmed", {}).get(sev, 0)
 
         table.add_row(
             f"[{color}]{sev}[/{color}]",
             str(splunk_only) if splunk_only else "-",
             str(scan_only) if scan_only else "-",
-            str(confirmed) if confirmed else "-"
+            str(confirmed) if confirmed else "-",
         )
 
     console.print("  ", table)
@@ -483,16 +553,31 @@ def _show_splunk_only(result: SplunkGapResult, width: int) -> None:
         width = DesignSystem.get_terminal_width()
 
         click.echo("\n┌" + "─" * (width - 2) + "┐")
-        click.echo("│" + click.style(" SPLUNK ONLY - SCANS MISSED ".center(width - 2), bold=True, fg='yellow') + "│")
+        click.echo(
+            "│"
+            + click.style(
+                " SPLUNK ONLY - SCANS MISSED ".center(width - 2), bold=True, fg="yellow"
+            )
+            + "│"
+        )
         click.echo("└" + "─" * (width - 2) + "┘")
         click.echo()
 
         click.echo(f"  {len(gaps)} CVEs detected by Splunk but NOT by active scans.")
-        click.echo(click.style("  These may be local/package vulnerabilities not exposed to network scanning.", fg='bright_black'))
+        click.echo(
+            click.style(
+                "  These may be local/package vulnerabilities not exposed to network scanning.",
+                fg="bright_black",
+            )
+        )
         click.echo()
 
         if not gaps:
-            click.echo(click.style("  V No gaps - all Splunk vulns confirmed by scans!", fg='green'))
+            click.echo(
+                click.style(
+                    "  V No gaps - all Splunk vulns confirmed by scans!", fg="green"
+                )
+            )
             click.echo()
             click.pause("  Press any key to return...")
             return
@@ -508,7 +593,13 @@ def _show_splunk_only(result: SplunkGapResult, width: int) -> None:
             end_idx = min(start_idx + page_size, len(gaps))
             page_gaps = gaps[start_idx:end_idx]
 
-        _render_gaps_table(page_gaps, show_package=True, page=page, page_size=page_size, view_all=view_all)
+        _render_gaps_table(
+            page_gaps,
+            show_package=True,
+            page=page,
+            page_size=page_size,
+            view_all=view_all,
+        )
 
         # Pagination info
         if view_all:
@@ -534,17 +625,17 @@ def _show_splunk_only(result: SplunkGapResult, width: int) -> None:
         try:
             choice = input("  Select option: ").strip().lower()
 
-            if choice == 'q':
+            if choice == "q":
                 return
-            elif choice == 'i':
+            elif choice == "i":
                 _interactive_gaps_mode(gaps, "SPLUNK ONLY GAPS", show_package=True)
-            elif choice == 't':
+            elif choice == "t":
                 view_all = not view_all
                 if not view_all:
                     page = 0
-            elif choice == 'n' and not view_all and page < total_pages - 1:
+            elif choice == "n" and not view_all and page < total_pages - 1:
                 page += 1
-            elif choice == 'p' and not view_all and page > 0:
+            elif choice == "p" and not view_all and page > 0:
                 page -= 1
             elif choice.isdigit():
                 idx = int(choice) - 1
@@ -566,16 +657,31 @@ def _show_scan_only(result: SplunkGapResult, width: int) -> None:
         width = DesignSystem.get_terminal_width()
 
         click.echo("\n┌" + "─" * (width - 2) + "┐")
-        click.echo("│" + click.style(" SCAN ONLY - SPLUNK MISSED ".center(width - 2), bold=True, fg='blue') + "│")
+        click.echo(
+            "│"
+            + click.style(
+                " SCAN ONLY - SPLUNK MISSED ".center(width - 2), bold=True, fg="blue"
+            )
+            + "│"
+        )
         click.echo("└" + "─" * (width - 2) + "┘")
         click.echo()
 
         click.echo(f"  {len(gaps)} CVEs detected by active scans but NOT by Splunk.")
-        click.echo(click.style("  This may indicate: missing Wazuh agent, detection rule gap, or network-only vuln.", fg='bright_black'))
+        click.echo(
+            click.style(
+                "  This may indicate: missing Wazuh agent, detection rule gap, or network-only vuln.",
+                fg="bright_black",
+            )
+        )
         click.echo()
 
         if not gaps:
-            click.echo(click.style("  V No gaps - Splunk detected all scan findings!", fg='green'))
+            click.echo(
+                click.style(
+                    "  V No gaps - Splunk detected all scan findings!", fg="green"
+                )
+            )
             click.echo()
             click.pause("  Press any key to return...")
             return
@@ -591,7 +697,9 @@ def _show_scan_only(result: SplunkGapResult, width: int) -> None:
             end_idx = min(start_idx + page_size, len(gaps))
             page_gaps = gaps[start_idx:end_idx]
 
-        _render_gaps_table(page_gaps, show_tool=True, page=page, page_size=page_size, view_all=view_all)
+        _render_gaps_table(
+            page_gaps, show_tool=True, page=page, page_size=page_size, view_all=view_all
+        )
 
         # Pagination info
         if view_all:
@@ -617,17 +725,17 @@ def _show_scan_only(result: SplunkGapResult, width: int) -> None:
         try:
             choice = input("  Select option: ").strip().lower()
 
-            if choice == 'q':
+            if choice == "q":
                 return
-            elif choice == 'i':
+            elif choice == "i":
                 _interactive_gaps_mode(gaps, "SCAN ONLY GAPS", show_tool=True)
-            elif choice == 't':
+            elif choice == "t":
                 view_all = not view_all
                 if not view_all:
                     page = 0
-            elif choice == 'n' and not view_all and page < total_pages - 1:
+            elif choice == "n" and not view_all and page < total_pages - 1:
                 page += 1
-            elif choice == 'p' and not view_all and page > 0:
+            elif choice == "p" and not view_all and page > 0:
                 page -= 1
             elif choice.isdigit():
                 idx = int(choice) - 1
@@ -649,16 +757,31 @@ def _show_confirmed(result: SplunkGapResult, width: int) -> None:
         width = DesignSystem.get_terminal_width()
 
         click.echo("\n┌" + "─" * (width - 2) + "┐")
-        click.echo("│" + click.style(" CONFIRMED - BOTH SOURCES ".center(width - 2), bold=True, fg='green') + "│")
+        click.echo(
+            "│"
+            + click.style(
+                " CONFIRMED - BOTH SOURCES ".center(width - 2), bold=True, fg="green"
+            )
+            + "│"
+        )
         click.echo("└" + "─" * (width - 2) + "┘")
         click.echo()
 
         click.echo(f"  {len(gaps)} CVEs detected by BOTH Splunk and active scans.")
-        click.echo(click.style("  High confidence - prioritize these for exploitation.", fg='bright_black'))
+        click.echo(
+            click.style(
+                "  High confidence - prioritize these for exploitation.",
+                fg="bright_black",
+            )
+        )
         click.echo()
 
         if not gaps:
-            click.echo(click.style("  No confirmed matches between Splunk and scans.", fg='yellow'))
+            click.echo(
+                click.style(
+                    "  No confirmed matches between Splunk and scans.", fg="yellow"
+                )
+            )
             click.echo()
             click.pause("  Press any key to return...")
             return
@@ -674,7 +797,9 @@ def _show_confirmed(result: SplunkGapResult, width: int) -> None:
             end_idx = min(start_idx + page_size, len(gaps))
             page_gaps = gaps[start_idx:end_idx]
 
-        _render_gaps_table(page_gaps, show_both=True, page=page, page_size=page_size, view_all=view_all)
+        _render_gaps_table(
+            page_gaps, show_both=True, page=page, page_size=page_size, view_all=view_all
+        )
 
         # Pagination info
         if view_all:
@@ -700,17 +825,17 @@ def _show_confirmed(result: SplunkGapResult, width: int) -> None:
         try:
             choice = input("  Select option: ").strip().lower()
 
-            if choice == 'q':
+            if choice == "q":
                 return
-            elif choice == 'i':
+            elif choice == "i":
                 _interactive_gaps_mode(gaps, "CONFIRMED GAPS", show_both=True)
-            elif choice == 't':
+            elif choice == "t":
                 view_all = not view_all
                 if not view_all:
                     page = 0
-            elif choice == 'n' and not view_all and page < total_pages - 1:
+            elif choice == "n" and not view_all and page < total_pages - 1:
                 page += 1
-            elif choice == 'p' and not view_all and page > 0:
+            elif choice == "p" and not view_all and page > 0:
                 page -= 1
             elif choice.isdigit():
                 idx = int(choice) - 1
@@ -729,35 +854,53 @@ def _show_actionable_gaps(result: SplunkGapResult, width: int) -> None:
     # Get high-priority gaps (Critical/High severity from Splunk that scans missed)
     gaps = []
     for g in result.splunk_only:
-        if g.severity in ('Critical', 'High'):
-            gaps.append({
-                'cve_id': g.cve_id,
-                'severity': g.severity,
-                'host_ip': g.host_ip,
-                'package': g.splunk_details.get('package_name', '-') if g.splunk_details else '-',
-                'package_version': g.splunk_details.get('package_version', '-') if g.splunk_details else '-',
-                'recommendation': g.recommendation,
-                'priority': 'high' if g.severity == 'Critical' else 'medium'
-            })
+        if g.severity in ("Critical", "High"):
+            gaps.append(
+                {
+                    "cve_id": g.cve_id,
+                    "severity": g.severity,
+                    "host_ip": g.host_ip,
+                    "package": (
+                        g.splunk_details.get("package_name", "-")
+                        if g.splunk_details
+                        else "-"
+                    ),
+                    "package_version": (
+                        g.splunk_details.get("package_version", "-")
+                        if g.splunk_details
+                        else "-"
+                    ),
+                    "recommendation": g.recommendation,
+                    "priority": "high" if g.severity == "Critical" else "medium",
+                }
+            )
 
     # Sort by severity
-    severity_order = {'Critical': 0, 'High': 1, 'Medium': 2, 'Low': 3}
-    gaps.sort(key=lambda x: severity_order.get(x['severity'], 4))
+    severity_order = {"Critical": 0, "High": 1, "Medium": 2, "Low": 3}
+    gaps.sort(key=lambda x: severity_order.get(x["severity"], 4))
 
     while True:
         DesignSystem.clear_screen()
         width = DesignSystem.get_terminal_width()
 
         click.echo("\n┌" + "─" * (width - 2) + "┐")
-        click.echo("│" + click.style(" ACTIONABLE GAPS ".center(width - 2), bold=True, fg='yellow') + "│")
+        click.echo(
+            "│"
+            + click.style(" ACTIONABLE GAPS ".center(width - 2), bold=True, fg="yellow")
+            + "│"
+        )
         click.echo("└" + "─" * (width - 2) + "┘")
         click.echo()
 
-        click.echo(f"  {len(gaps)} prioritized vulnerabilities from Splunk that need targeted scanning.")
+        click.echo(
+            f"  {len(gaps)} prioritized vulnerabilities from Splunk that need targeted scanning."
+        )
         click.echo()
 
         if not gaps:
-            click.echo(click.style("  V No actionable gaps - great scan coverage!", fg='green'))
+            click.echo(
+                click.style("  V No actionable gaps - great scan coverage!", fg="green")
+            )
             click.echo()
             click.pause("  Press any key to return...")
             return
@@ -791,21 +934,23 @@ def _show_actionable_gaps(result: SplunkGapResult, width: int) -> None:
             else:
                 display_idx = (page * page_size) + idx + 1
 
-            priority = gap.get('priority', 'medium')
-            priority_display = "[red]HIGH[/red]" if priority == 'high' else "[yellow]MEDIUM[/yellow]"
+            priority = gap.get("priority", "medium")
+            priority_display = (
+                "[red]HIGH[/red]" if priority == "high" else "[yellow]MEDIUM[/yellow]"
+            )
 
-            severity = gap.get('severity', 'Medium')
-            sev_color = SEVERITY_COLORS.get(severity, 'white')
+            severity = gap.get("severity", "Medium")
+            sev_color = SEVERITY_COLORS.get(severity, "white")
 
             table.add_row(
                 "○",
                 str(display_idx),
                 priority_display,
-                gap.get('cve_id', '-'),
+                gap.get("cve_id", "-"),
                 f"[{sev_color}]{severity}[/{sev_color}]",
-                gap.get('host_ip', '-'),
-                gap.get('package', '-')[:19],
-                gap.get('recommendation', '-')[:34]
+                gap.get("host_ip", "-"),
+                gap.get("package", "-")[:19],
+                gap.get("recommendation", "-")[:34],
             )
 
         console.print(table)
@@ -834,17 +979,17 @@ def _show_actionable_gaps(result: SplunkGapResult, width: int) -> None:
         try:
             choice = input("  Select option: ").strip().lower()
 
-            if choice == 'q':
+            if choice == "q":
                 return
-            elif choice == 'i':
+            elif choice == "i":
                 _interactive_actionable_gaps_mode(gaps)
-            elif choice == 't':
+            elif choice == "t":
                 view_all = not view_all
                 if not view_all:
                     page = 0
-            elif choice == 'n' and not view_all and page < total_pages - 1:
+            elif choice == "n" and not view_all and page < total_pages - 1:
                 page += 1
-            elif choice == 'p' and not view_all and page > 0:
+            elif choice == "p" and not view_all and page > 0:
                 page -= 1
             elif choice.isdigit():
                 idx = int(choice) - 1
@@ -855,8 +1000,13 @@ def _show_actionable_gaps(result: SplunkGapResult, width: int) -> None:
 
 
 def _render_gaps_table(
-    gaps: List, show_package: bool = False, show_tool: bool = False, show_both: bool = False,
-    page: int = 0, page_size: int = 20, view_all: bool = False
+    gaps: List,
+    show_package: bool = False,
+    show_tool: bool = False,
+    show_both: bool = False,
+    page: int = 0,
+    page_size: int = 20,
+    view_all: bool = False,
 ) -> None:
     """Render gaps table with pagination support."""
     table = DesignSystem.create_table()
@@ -885,27 +1035,35 @@ def _render_gaps_table(
             display_idx = (page * page_size) + idx + 1
 
         severity = gap.severity
-        sev_color = SEVERITY_COLORS.get(severity, 'white')
+        sev_color = SEVERITY_COLORS.get(severity, "white")
 
         row = [
             "○",
             str(display_idx),
             gap.cve_id,
             f"[{sev_color}]{severity}[/{sev_color}]",
-            gap.host_ip or "-"
+            gap.host_ip or "-",
         ]
 
         if show_package:
-            package = gap.splunk_details.get('package_name', '-') if gap.splunk_details else '-'
+            package = (
+                gap.splunk_details.get("package_name", "-")
+                if gap.splunk_details
+                else "-"
+            )
             row.append(package[:24])
             row.append(gap.recommendation[:34])
         elif show_tool:
-            tool = gap.scan_details.get('tool', '-') if gap.scan_details else '-'
+            tool = gap.scan_details.get("tool", "-") if gap.scan_details else "-"
             row.append(tool)
             row.append(gap.recommendation[:39])
         elif show_both:
-            package = gap.splunk_details.get('package_name', '-') if gap.splunk_details else '-'
-            tool = gap.scan_details.get('tool', '-') if gap.scan_details else '-'
+            package = (
+                gap.splunk_details.get("package_name", "-")
+                if gap.splunk_details
+                else "-"
+            )
+            tool = gap.scan_details.get("tool", "-") if gap.scan_details else "-"
             row.append(package[:19])
             row.append(tool)
             row.append(f"[green]{gap.confidence}[/green]")
@@ -920,12 +1078,14 @@ def _show_gap_detail(gap: SplunkVulnGap) -> None:
     DesignSystem.clear_screen()
     width = DesignSystem.get_terminal_width()
 
-    cve = gap.cve_id or 'Unknown'
-    severity = gap.severity or 'Medium'
-    sev_color = SEVERITY_COLORS.get(severity, 'white')
+    cve = gap.cve_id or "Unknown"
+    severity = gap.severity or "Medium"
+    sev_color = SEVERITY_COLORS.get(severity, "white")
 
     click.echo("\n┌" + "─" * (width - 2) + "┐")
-    click.echo("│" + click.style(f" {cve} ".center(width - 2), bold=True, fg='cyan') + "│")
+    click.echo(
+        "│" + click.style(f" {cve} ".center(width - 2), bold=True, fg="cyan") + "│"
+    )
     click.echo("└" + "─" * (width - 2) + "┘")
     click.echo()
 
@@ -964,20 +1124,24 @@ def _show_actionable_gap_detail(gap: Dict) -> None:
     DesignSystem.clear_screen()
     width = DesignSystem.get_terminal_width()
 
-    cve = gap.get('cve_id', 'Unknown')
-    severity = gap.get('severity', 'Medium')
-    sev_color = SEVERITY_COLORS.get(severity, 'white')
+    cve = gap.get("cve_id", "Unknown")
+    severity = gap.get("severity", "Medium")
+    sev_color = SEVERITY_COLORS.get(severity, "white")
 
     click.echo("\n┌" + "─" * (width - 2) + "┐")
-    click.echo("│" + click.style(f" {cve} ".center(width - 2), bold=True, fg='cyan') + "│")
+    click.echo(
+        "│" + click.style(f" {cve} ".center(width - 2), bold=True, fg="cyan") + "│"
+    )
     click.echo("└" + "─" * (width - 2) + "┘")
     click.echo()
 
-    priority = gap.get('priority', 'medium')
-    priority_color = 'red' if priority == 'high' else 'yellow'
+    priority = gap.get("priority", "medium")
+    priority_color = "red" if priority == "high" else "yellow"
 
     click.echo(f"  Severity: " + click.style(severity, fg=sev_color, bold=True))
-    click.echo(f"  Priority: " + click.style(priority.upper(), fg=priority_color, bold=True))
+    click.echo(
+        f"  Priority: " + click.style(priority.upper(), fg=priority_color, bold=True)
+    )
     click.echo(f"  Host: {gap.get('host_ip', '-')}")
     click.echo()
 
@@ -986,7 +1150,7 @@ def _show_actionable_gap_detail(gap: Dict) -> None:
     click.echo(f"    Version: {gap.get('package_version', '-')}")
     click.echo()
 
-    if gap.get('recommendation'):
+    if gap.get("recommendation"):
         click.echo(click.style("  Recommendation:", bold=True))
         click.echo(f"    {gap.get('recommendation')}")
         click.echo()
@@ -995,13 +1159,17 @@ def _show_actionable_gap_detail(gap: Dict) -> None:
 
 
 def _interactive_gaps_mode(
-    gaps: List, title: str, show_package: bool = False, show_tool: bool = False, show_both: bool = False
+    gaps: List,
+    title: str,
+    show_package: bool = False,
+    show_tool: bool = False,
+    show_both: bool = False,
 ) -> None:
     """Interactive selection mode for gaps."""
     from souleyez.ui.interactive_selector import interactive_select
 
     if not gaps:
-        click.echo(click.style("  No gaps to select.", fg='yellow'))
+        click.echo(click.style("  No gaps to select.", fg="yellow"))
         click.pause()
         return
 
@@ -1009,57 +1177,69 @@ def _interactive_gaps_mode(
     gap_items = []
     for gap in gaps:
         item = {
-            'id': id(gap),
-            'cve_id': gap.cve_id or '-',
-            'severity': gap.severity or 'Medium',
-            'host': gap.host_ip or '-',
-            'raw': gap
+            "id": id(gap),
+            "cve_id": gap.cve_id or "-",
+            "severity": gap.severity or "Medium",
+            "host": gap.host_ip or "-",
+            "raw": gap,
         }
         if show_package:
-            item['package'] = gap.splunk_details.get('package_name', '-')[:20] if gap.splunk_details else '-'
+            item["package"] = (
+                gap.splunk_details.get("package_name", "-")[:20]
+                if gap.splunk_details
+                else "-"
+            )
         elif show_tool:
-            item['tool'] = gap.scan_details.get('tool', '-') if gap.scan_details else '-'
+            item["tool"] = (
+                gap.scan_details.get("tool", "-") if gap.scan_details else "-"
+            )
         elif show_both:
-            item['package'] = gap.splunk_details.get('package_name', '-')[:15] if gap.splunk_details else '-'
-            item['tool'] = gap.scan_details.get('tool', '-') if gap.scan_details else '-'
+            item["package"] = (
+                gap.splunk_details.get("package_name", "-")[:15]
+                if gap.splunk_details
+                else "-"
+            )
+            item["tool"] = (
+                gap.scan_details.get("tool", "-") if gap.scan_details else "-"
+            )
         gap_items.append(item)
 
     columns = [
-        {'name': 'CVE', 'key': 'cve_id', 'width': 18},
-        {'name': 'Severity', 'key': 'severity', 'width': 10},
-        {'name': 'Host', 'key': 'host', 'width': 15}
+        {"name": "CVE", "key": "cve_id", "width": 18},
+        {"name": "Severity", "key": "severity", "width": 10},
+        {"name": "Host", "key": "host", "width": 15},
     ]
 
     if show_package:
-        columns.append({'name': 'Package', 'key': 'package', 'width': 20})
+        columns.append({"name": "Package", "key": "package", "width": 20})
     elif show_tool:
-        columns.append({'name': 'Tool', 'key': 'tool', 'width': 15})
+        columns.append({"name": "Tool", "key": "tool", "width": 15})
     elif show_both:
-        columns.append({'name': 'Package', 'key': 'package', 'width': 15})
-        columns.append({'name': 'Tool', 'key': 'tool', 'width': 15})
+        columns.append({"name": "Package", "key": "package", "width": 15})
+        columns.append({"name": "Tool", "key": "tool", "width": 15})
 
     def format_cell(item: Dict, key: str) -> str:
-        if key == 'severity':
-            sev = item.get('severity', 'Medium')
-            color = SEVERITY_COLORS.get(sev, 'white')
+        if key == "severity":
+            sev = item.get("severity", "Medium")
+            color = SEVERITY_COLORS.get(sev, "white")
             return f"[{color}]{sev}[/{color}]"
-        return str(item.get(key, '-'))
+        return str(item.get(key, "-"))
 
     selected_ids: set = set()
     interactive_select(
         items=gap_items,
         columns=columns,
         selected_ids=selected_ids,
-        get_id=lambda g: g['id'],
+        get_id=lambda g: g["id"],
         title=title,
-        format_cell=format_cell
+        format_cell=format_cell,
     )
 
     # Show details of first selected
     if selected_ids:
         for item in gap_items:
-            if item['id'] in selected_ids:
-                _show_gap_detail(item['raw'])
+            if item["id"] in selected_ids:
+                _show_gap_detail(item["raw"])
                 break
 
 
@@ -1068,55 +1248,57 @@ def _interactive_actionable_gaps_mode(gaps: List[Dict]) -> None:
     from souleyez.ui.interactive_selector import interactive_select
 
     if not gaps:
-        click.echo(click.style("  No gaps to select.", fg='yellow'))
+        click.echo(click.style("  No gaps to select.", fg="yellow"))
         click.pause()
         return
 
     # Prepare items for interactive selector
     gap_items = []
     for gap in gaps:
-        gap_items.append({
-            'id': id(gap),
-            'cve_id': gap.get('cve_id', '-'),
-            'severity': gap.get('severity', 'Medium'),
-            'priority': gap.get('priority', 'medium').upper(),
-            'host': gap.get('host_ip', '-'),
-            'package': gap.get('package', '-')[:20],
-            'raw': gap
-        })
+        gap_items.append(
+            {
+                "id": id(gap),
+                "cve_id": gap.get("cve_id", "-"),
+                "severity": gap.get("severity", "Medium"),
+                "priority": gap.get("priority", "medium").upper(),
+                "host": gap.get("host_ip", "-"),
+                "package": gap.get("package", "-")[:20],
+                "raw": gap,
+            }
+        )
 
     columns = [
-        {'name': 'Priority', 'key': 'priority', 'width': 8},
-        {'name': 'CVE', 'key': 'cve_id', 'width': 18},
-        {'name': 'Severity', 'key': 'severity', 'width': 10},
-        {'name': 'Host', 'key': 'host', 'width': 15},
-        {'name': 'Package', 'key': 'package', 'width': 20}
+        {"name": "Priority", "key": "priority", "width": 8},
+        {"name": "CVE", "key": "cve_id", "width": 18},
+        {"name": "Severity", "key": "severity", "width": 10},
+        {"name": "Host", "key": "host", "width": 15},
+        {"name": "Package", "key": "package", "width": 20},
     ]
 
     def format_cell(item: Dict, key: str) -> str:
-        if key == 'severity':
-            sev = item.get('severity', 'Medium')
-            color = SEVERITY_COLORS.get(sev, 'white')
+        if key == "severity":
+            sev = item.get("severity", "Medium")
+            color = SEVERITY_COLORS.get(sev, "white")
             return f"[{color}]{sev}[/{color}]"
-        elif key == 'priority':
-            pri = item.get('priority', 'MEDIUM')
-            color = 'red' if pri == 'HIGH' else 'yellow'
+        elif key == "priority":
+            pri = item.get("priority", "MEDIUM")
+            color = "red" if pri == "HIGH" else "yellow"
             return f"[{color}]{pri}[/{color}]"
-        return str(item.get(key, '-'))
+        return str(item.get(key, "-"))
 
     selected_ids: set = set()
     interactive_select(
         items=gap_items,
         columns=columns,
         selected_ids=selected_ids,
-        get_id=lambda g: g['id'],
+        get_id=lambda g: g["id"],
         title="ACTIONABLE GAPS",
-        format_cell=format_cell
+        format_cell=format_cell,
     )
 
     # Show details of first selected
     if selected_ids:
         for item in gap_items:
-            if item['id'] in selected_ids:
-                _show_actionable_gap_detail(item['raw'])
+            if item["id"] in selected_ids:
+                _show_actionable_gap_detail(item["raw"])
                 break