souleyez 2.43.29__py3-none-any.whl → 3.0.0__py3-none-any.whl

souleyez/intelligence/gap_analyzer.py

@@ -18,6 +18,7 @@ logger = get_logger(__name__)
 @dataclass
 class VulnGap:
     """Represents a vulnerability gap between detection sources."""
+
     cve_id: str
     severity: str
     host_ip: str
@@ -31,6 +32,7 @@ class VulnGap:
 @dataclass
 class GapAnalysisResult:
     """Result of gap analysis."""
+
     wazuh_total: int = 0
     scan_total: int = 0
     wazuh_only: List[VulnGap] = field(default_factory=list)
@@ -71,24 +73,30 @@ class GapAnalyzer:
         result.scan_total = len(scan_findings)
 
         # Build lookup sets
-        wazuh_cve_hosts = {(v['cve_id'], v['host_ip']): v for v in wazuh_vulns if v.get('cve_id')}
-        scan_cve_hosts = {(f['cve_id'], f['host_ip']): f for f in scan_findings if f.get('cve_id')}
+        wazuh_cve_hosts = {
+            (v["cve_id"], v["host_ip"]): v for v in wazuh_vulns if v.get("cve_id")
+        }
+        scan_cve_hosts = {
+            (f["cve_id"], f["host_ip"]): f for f in scan_findings if f.get("cve_id")
+        }
 
         # Find confirmed (both sources)
         for key, wazuh_v in wazuh_cve_hosts.items():
             cve_id, host_ip = key
             if key in scan_cve_hosts:
                 scan_f = scan_cve_hosts[key]
-                result.confirmed.append(VulnGap(
-                    cve_id=cve_id,
-                    severity=wazuh_v.get('severity', 'Medium'),
-                    host_ip=host_ip,
-                    source='both',
-                    wazuh_details=wazuh_v,
-                    scan_details=scan_f,
-                    recommendation="High confidence - confirmed by both sources",
-                    confidence='high'
-                ))
+                result.confirmed.append(
+                    VulnGap(
+                        cve_id=cve_id,
+                        severity=wazuh_v.get("severity", "Medium"),
+                        host_ip=host_ip,
+                        source="both",
+                        wazuh_details=wazuh_v,
+                        scan_details=scan_f,
+                        recommendation="High confidence - confirmed by both sources",
+                        confidence="high",
+                    )
+                )
 
         # Find Wazuh-only (scan missed)
         for key, wazuh_v in wazuh_cve_hosts.items():
@@ -97,29 +105,33 @@ class GapAnalyzer:
                 # Check if any scan found this CVE on any host
                 cve_found_elsewhere = any(c == cve_id for c, _ in scan_cve_hosts.keys())
 
-                result.wazuh_only.append(VulnGap(
-                    cve_id=cve_id,
-                    severity=wazuh_v.get('severity', 'Medium'),
-                    host_ip=host_ip,
-                    source='wazuh',
-                    wazuh_details=wazuh_v,
-                    recommendation=self._get_scan_recommendation(cve_id, wazuh_v),
-                    confidence='medium' if cve_found_elsewhere else 'high'
-                ))
+                result.wazuh_only.append(
+                    VulnGap(
+                        cve_id=cve_id,
+                        severity=wazuh_v.get("severity", "Medium"),
+                        host_ip=host_ip,
+                        source="wazuh",
+                        wazuh_details=wazuh_v,
+                        recommendation=self._get_scan_recommendation(cve_id, wazuh_v),
+                        confidence="medium" if cve_found_elsewhere else "high",
+                    )
+                )
 
         # Find scan-only (Wazuh missed)
         for key, scan_f in scan_cve_hosts.items():
             cve_id, host_ip = key
             if key not in wazuh_cve_hosts:
-                result.scan_only.append(VulnGap(
-                    cve_id=cve_id,
-                    severity=scan_f.get('severity', 'medium'),
-                    host_ip=host_ip,
-                    source='scan',
-                    scan_details=scan_f,
-                    recommendation="Wazuh agent may not have detection rule for this CVE",
-                    confidence='medium'
-                ))
+                result.scan_only.append(
+                    VulnGap(
+                        cve_id=cve_id,
+                        severity=scan_f.get("severity", "medium"),
+                        host_ip=host_ip,
+                        source="scan",
+                        scan_details=scan_f,
+                        recommendation="Wazuh agent may not have detection rule for this CVE",
+                        confidence="medium",
+                    )
+                )
 
         # Calculate coverage percentage
         if result.wazuh_total > 0:
@@ -136,12 +148,18 @@ class GapAnalyzer:
         result = self.analyze()
         return [
             {
-                'cve_id': gap.cve_id,
-                'severity': gap.severity,
-                'host_ip': gap.host_ip,
-                'package_name': gap.wazuh_details.get('package_name') if gap.wazuh_details else None,
-                'package_version': gap.wazuh_details.get('package_version') if gap.wazuh_details else None,
-                'recommendation': gap.recommendation
+                "cve_id": gap.cve_id,
+                "severity": gap.severity,
+                "host_ip": gap.host_ip,
+                "package_name": (
+                    gap.wazuh_details.get("package_name") if gap.wazuh_details else None
+                ),
+                "package_version": (
+                    gap.wazuh_details.get("package_version")
+                    if gap.wazuh_details
+                    else None
+                ),
+                "recommendation": gap.recommendation,
             }
             for gap in result.wazuh_only
         ]
@@ -158,11 +176,11 @@ class GapAnalyzer:
         result = self.analyze()
         return [
             {
-                'cve_id': gap.cve_id,
-                'severity': gap.severity,
-                'host_ip': gap.host_ip,
-                'tool': gap.scan_details.get('tool') if gap.scan_details else None,
-                'recommendation': gap.recommendation
+                "cve_id": gap.cve_id,
+                "severity": gap.severity,
+                "host_ip": gap.host_ip,
+                "tool": gap.scan_details.get("tool") if gap.scan_details else None,
+                "recommendation": gap.recommendation,
             }
             for gap in result.scan_only
         ]
@@ -174,12 +192,14 @@ class GapAnalyzer:
         result = self.analyze()
         return [
             {
-                'cve_id': gap.cve_id,
-                'severity': gap.severity,
-                'host_ip': gap.host_ip,
-                'package_name': gap.wazuh_details.get('package_name') if gap.wazuh_details else None,
-                'scan_tool': gap.scan_details.get('tool') if gap.scan_details else None,
-                'confidence': 'high'
+                "cve_id": gap.cve_id,
+                "severity": gap.severity,
+                "host_ip": gap.host_ip,
+                "package_name": (
+                    gap.wazuh_details.get("package_name") if gap.wazuh_details else None
+                ),
+                "scan_tool": gap.scan_details.get("tool") if gap.scan_details else None,
+                "confidence": "high",
             }
             for gap in result.confirmed
         ]
@@ -194,13 +214,13 @@ class GapAnalyzer:
         result = self.analyze()
 
         return {
-            'wazuh_total': result.wazuh_total,
-            'scan_total': result.scan_total,
-            'wazuh_only_count': len(result.wazuh_only),
-            'scan_only_count': len(result.scan_only),
-            'confirmed_count': len(result.confirmed),
-            'coverage_pct': round(result.coverage_pct, 1),
-            'by_severity': self._get_severity_breakdown(result)
+            "wazuh_total": result.wazuh_total,
+            "scan_total": result.scan_total,
+            "wazuh_only_count": len(result.wazuh_only),
+            "scan_only_count": len(result.scan_only),
+            "confirmed_count": len(result.confirmed),
+            "coverage_pct": round(result.coverage_pct, 1),
+            "by_severity": self._get_severity_breakdown(result),
         }
 
     def get_actionable_gaps(self, limit: int = 20) -> List[Dict[str, Any]]:
@@ -212,22 +232,29 @@ class GapAnalyzer:
         result = self.analyze()
 
         # Sort by severity
-        severity_order = {'Critical': 0, 'High': 1, 'Medium': 2, 'Low': 3}
+        severity_order = {"Critical": 0, "High": 1, "Medium": 2, "Low": 3}
 
         sorted_gaps = sorted(
-            result.wazuh_only,
-            key=lambda g: severity_order.get(g.severity, 4)
+            result.wazuh_only, key=lambda g: severity_order.get(g.severity, 4)
         )
 
         return [
             {
-                'cve_id': gap.cve_id,
-                'severity': gap.severity,
-                'host_ip': gap.host_ip,
-                'package': gap.wazuh_details.get('package_name') if gap.wazuh_details else None,
-                'version': gap.wazuh_details.get('package_version') if gap.wazuh_details else None,
-                'recommendation': gap.recommendation,
-                'priority': 'high' if gap.severity in ['Critical', 'High'] else 'medium'
+                "cve_id": gap.cve_id,
+                "severity": gap.severity,
+                "host_ip": gap.host_ip,
+                "package": (
+                    gap.wazuh_details.get("package_name") if gap.wazuh_details else None
+                ),
+                "version": (
+                    gap.wazuh_details.get("package_version")
+                    if gap.wazuh_details
+                    else None
+                ),
+                "recommendation": gap.recommendation,
+                "priority": (
+                    "high" if gap.severity in ["Critical", "High"] else "medium"
+                ),
             }
             for gap in sorted_gaps[:limit]
         ]
@@ -254,7 +281,7 @@ class GapAnalyzer:
         vulns = []
         for r in results:
             vuln = dict(r)
-            vuln['host_ip'] = r.get('mapped_host_ip') or r.get('host_ip')
+            vuln["host_ip"] = r.get("mapped_host_ip") or r.get("host_ip")
             vulns.append(vuln)
 
         return vulns
@@ -278,14 +305,16 @@ class GapAnalyzer:
 
         for r in nuclei_results:
             # Extract IP from matched_at URL
-            host_ip = self._extract_ip(r.get('matched_at', ''))
+            host_ip = self._extract_ip(r.get("matched_at", ""))
             if host_ip:
-                findings.append({
-                    'cve_id': r['cve_id'],
-                    'severity': r.get('severity', 'medium'),
-                    'host_ip': host_ip,
-                    'tool': 'nuclei'
-                })
+                findings.append(
+                    {
+                        "cve_id": r["cve_id"],
+                        "severity": r.get("severity", "medium"),
+                        "host_ip": host_ip,
+                        "tool": "nuclei",
+                    }
+                )
 
         # Get from findings table (check refs/title for CVE)
         findings_query = """
@@ -303,14 +332,18 @@ class GapAnalyzer:
 
         for r in findings_results:
             # Extract CVE from title or refs
-            cve_id = self._extract_cve(r.get('title', '')) or self._extract_cve(r.get('refs', ''))
-            if cve_id and r.get('host_ip'):
-                findings.append({
-                    'cve_id': cve_id,
-                    'severity': r.get('severity', 'medium'),
-                    'host_ip': r['host_ip'],
-                    'tool': r.get('tool', 'unknown')
-                })
+            cve_id = self._extract_cve(r.get("title", "")) or self._extract_cve(
+                r.get("refs", "")
+            )
+            if cve_id and r.get("host_ip"):
+                findings.append(
+                    {
+                        "cve_id": cve_id,
+                        "severity": r.get("severity", "medium"),
+                        "host_ip": r["host_ip"],
+                        "tool": r.get("tool", "unknown"),
+                    }
+                )
 
         return findings
 
@@ -319,7 +352,7 @@ class GapAnalyzer:
         if not text:
             return None
 
-        match = re.search(r'CVE-\d{4}-\d{4,}', text, re.IGNORECASE)
+        match = re.search(r"CVE-\d{4}-\d{4,}", text, re.IGNORECASE)
         if match:
             return match.group(0).upper()
 
@@ -331,7 +364,7 @@ class GapAnalyzer:
             return None
 
         # Try to extract IP from URL like https://10.0.0.1:443/path
-        ip_pattern = r'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
+        ip_pattern = r"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
         match = re.search(ip_pattern, url)
         if match:
             return match.group(1)
@@ -340,35 +373,37 @@ class GapAnalyzer:
 
     def _get_scan_recommendation(self, cve_id: str, wazuh_details: Dict) -> str:
         """Generate scan recommendation for a Wazuh-only CVE."""
-        package = wazuh_details.get('package_name', 'unknown')
-        severity = wazuh_details.get('severity', 'Medium')
+        package = wazuh_details.get("package_name", "unknown")
+        severity = wazuh_details.get("severity", "Medium")
 
-        if severity in ['Critical', 'High']:
+        if severity in ["Critical", "High"]:
             return f"Run targeted nuclei scan: nuclei -t cves/{cve_id.lower()}.yaml"
 
         return f"Verify {cve_id} in {package} - may not be network exploitable"
 
-    def _get_severity_breakdown(self, result: GapAnalysisResult) -> Dict[str, Dict[str, int]]:
+    def _get_severity_breakdown(
+        self, result: GapAnalysisResult
+    ) -> Dict[str, Dict[str, int]]:
         """Get counts by severity for each category."""
         breakdown = {
-            'wazuh_only': {'Critical': 0, 'High': 0, 'Medium': 0, 'Low': 0},
-            'scan_only': {'Critical': 0, 'High': 0, 'Medium': 0, 'Low': 0},
-            'confirmed': {'Critical': 0, 'High': 0, 'Medium': 0, 'Low': 0}
+            "wazuh_only": {"Critical": 0, "High": 0, "Medium": 0, "Low": 0},
+            "scan_only": {"Critical": 0, "High": 0, "Medium": 0, "Low": 0},
+            "confirmed": {"Critical": 0, "High": 0, "Medium": 0, "Low": 0},
         }
 
         for gap in result.wazuh_only:
-            sev = gap.severity if gap.severity in breakdown['wazuh_only'] else 'Medium'
-            breakdown['wazuh_only'][sev] += 1
+            sev = gap.severity if gap.severity in breakdown["wazuh_only"] else "Medium"
+            breakdown["wazuh_only"][sev] += 1
 
         for gap in result.scan_only:
             # Normalize severity (scan findings use lowercase)
-            sev = gap.severity.capitalize() if gap.severity else 'Medium'
-            if sev not in breakdown['scan_only']:
-                sev = 'Medium'
-            breakdown['scan_only'][sev] += 1
+            sev = gap.severity.capitalize() if gap.severity else "Medium"
+            if sev not in breakdown["scan_only"]:
+                sev = "Medium"
+            breakdown["scan_only"][sev] += 1
 
         for gap in result.confirmed:
-            sev = gap.severity if gap.severity in breakdown['confirmed'] else 'Medium'
-            breakdown['confirmed'][sev] += 1
+            sev = gap.severity if gap.severity in breakdown["confirmed"] else "Medium"
+            breakdown["confirmed"][sev] += 1
 
         return breakdown