xpl-intel 1.2.0__tar.gz

xpl_intel-1.2.0/LICENSE

@@ -0,0 +1,123 @@
+# XPL-Suite Security Research License (XSRL) v1.0
+
+Copyright (c) 2024-2026 Andre Henrike de Oliveira (@mrhenrike) / Uniao Geek
+All rights reserved.
+
+## 1. Definitions
+
+- "Software" means the source code, documentation, binaries, scripts, configuration
+  files, and any other materials included in this repository.
+- "Author" means the original copyright holder: Andre Henrike de Oliveira (@mrhenrike).
+- "Original Repository" means the source repository hosted at
+  https://github.com/mrhenrike/xpl-intel from which the Software originates.
+- "Upstream Credits" means the authors and licenses of third-party components,
+  libraries, or code referenced in the Software, as documented in source file headers,
+  CREDITS files, or README attribution sections.
+- "Authorized Security Testing" means penetration testing, vulnerability assessment,
+  red team exercises, purple team exercises, security auditing, or similar activities
+  conducted with explicit written permission from the owner of the target system(s).
+
+## 2. Grant of Rights
+
+Subject to the terms and conditions of this License, the Author grants you a
+non-exclusive, worldwide, royalty-free license to:
+
+a) **Use** the Software for educational purposes, academic research, security studies,
+   and Authorized Security Testing;
+b) **Copy and reproduce** the Software;
+c) **Modify** the Software and create derivative works;
+d) **Fork** the Software and maintain independent copies;
+e) **Distribute** the Software and derivative works, provided all conditions in
+   Section 3 are met.
+
+## 3. Conditions
+
+Any use, copy, modification, fork, or distribution of the Software must comply with
+ALL of the following conditions:
+
+### 3.1 Attribution
+
+a) You must retain the Author's original copyright notice and attribution in all
+   copies and derivative works.
+b) You must retain all Upstream Credits, including but not limited to: original author
+   names, license notices, and attribution statements of third-party code used as a
+   base or reference for the Software.
+c) Modified files must carry a prominent notice stating that you changed the files and
+   the date of any change.
+d) Derivative works must include a clear statement identifying the original Software
+   and its Author.
+e) Any copy, fork, or derivative work must include a visible reference to the Original
+   Repository URL (https://github.com/mrhenrike/xpl-intel) in the project's
+   README or equivalent documentation, so that users can trace the Software back to
+   its source.
+f) The Author's name and credits must not be removed, obscured, or replaced in any
+   copy, fork, or derivative work. The Author must remain credited as the original
+   creator in all circumstances.
+
+### 3.2 Same License
+
+a) Any distribution of the Software or derivative works must be under this same
+   License (XSRL v1.0).
+b) You may not apply any additional restrictions or alternative license terms to the
+   Software or derivative works.
+c) You may not sublicense the Software under different terms.
+
+### 3.3 Non-Commercial Use Only
+
+a) The Software may not be used, in whole or in part, for commercial purposes.
+b) "Commercial purposes" includes but is not limited to: selling the Software or
+   derivative works, incorporating the Software into commercial products or services,
+   using the Software to generate revenue directly or indirectly, and offering the
+   Software as part of a paid service.
+c) Use in non-profit organizations, academic institutions, and personal projects is
+   permitted, provided no commercial gain is derived.
+
+### 3.4 Ethical Use Only
+
+a) The Software may only be used for:
+   - Educational purposes and academic research;
+   - Security studies, training, and skill development;
+   - Authorized Security Testing (as defined in Section 1);
+   - Capture The Flag (CTF) competitions and security labs;
+   - Defensive security, incident response, and threat analysis.
+
+b) The Software may NOT be used for:
+   - Unauthorized access to systems, networks, or data;
+   - Any activity that violates applicable laws or regulations;
+   - Malicious purposes, including but not limited to: deploying malware against
+     unauthorized targets, conducting denial-of-service attacks, unauthorized
+     surveillance, data theft, or any form of cybercrime;
+   - Targeting individuals, organizations, or infrastructure without explicit
+     authorization;
+   - Any purpose that causes harm to individuals or organizations.
+
+## 4. No Warranty
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+## 5. Limitation of Liability
+
+The Author shall not be held responsible for any misuse of the Software. Users are
+solely responsible for ensuring their use of the Software complies with all applicable
+laws, regulations, and ethical standards.
+
+## 6. Termination
+
+This License and the rights granted hereunder will terminate automatically if you fail
+to comply with any of the terms and conditions of this License. Upon termination, you
+must cease all use and destroy all copies of the Software in your possession.
+
+## 7. Severability
+
+If any provision of this License is held to be unenforceable, such provision shall be
+reformed only to the extent necessary to make it enforceable, and the remaining
+provisions shall continue in full force and effect.
+
+---
+
+SPDX-License-Identifier: LicenseRef-XSRL-1.0

xpl_intel-1.2.0/PKG-INFO

@@ -0,0 +1,24 @@
+Metadata-Version: 2.4
+Name: xpl-intel
+Version: 1.2.0
+Summary: XPL-Intel — CVE ingestion pipeline for XPL-Suite. CISA KEV, NVD, watchTowr, Nuclei, ExploitDB.
+Author-email: André Henrique <henrique.santos@uniaogeek.com.br>
+License: XSRL-1.0
+Keywords: cve,vulnerability,intel,kev,nvd,nuclei,xpl-suite
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+License-File: LICENSE
+Requires-Dist: requests<3.0,>=2.31.0
+Requires-Dist: rich>=13.0
+Requires-Dist: defusedxml>=0.7.1
+Requires-Dist: argcomplete>=3.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.0; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"
+Requires-Dist: mypy>=1.10; extra == "dev"
+Requires-Dist: types-requests>=2.31; extra == "dev"
+Dynamic: license-file

xpl_intel-1.2.0/README.md

@@ -0,0 +1,55 @@
+# xpl-intel
+
+CVE ingestion and threat intelligence pipeline for [XPL-Suite](https://github.com/mrhenrike).
+
+## Overview
+
+`xpl-intel` aggregates vulnerability data from multiple authoritative sources into a unified advisory format:
+
+### Ingestion Sources
+- **CISA KEV** — Known Exploited Vulnerabilities catalog
+- **NVD API** — NIST National Vulnerability Database
+- **VulnCheck KEV** — VulnCheck enriched KEV data
+- **ExploitDB** — Exploit Database (CSV mirror)
+- **GitHub Advisory (GHSA)** — GitHub Security Advisories
+- **Nuclei Templates** — ProjectDiscovery Nuclei CVE templates
+- **watchTowr RSS** — watchTowr Labs advisory feed
+- **PacketStorm RSS** — PacketStorm Security exploit feed (NEW)
+- **EPSS API** — FIRST Exploit Prediction Scoring System enrichment (NEW)
+
+### Output Formats
+- JSON (structured advisory records)
+- CSV (tabular export)
+- SQLite (queryable local database)
+
+## Installation
+
+```bash
+pip install xpl-intel
+```
+
+## Quick Start
+
+```bash
+# Ingest from all sources
+xpl-intel ingest --all
+
+# Ingest from specific source
+xpl-intel ingest --source cisa_kev
+
+# Output to SQLite
+xpl-intel ingest --all --output sqlite --db vulns.db
+```
+
+## Requirements
+
+- Python >= 3.9
+- `requests`, `rich`, `defusedxml`, `argcomplete`
+
+## License
+
+XSRL-1.0. See [LICENSE](LICENSE).
+
+## Author
+
+André Henrique ([@mrhenrike](https://github.com/mrhenrike)) | União Geek

xpl_intel-1.2.0/ingestion/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "1.2.0"
+PRODUCT = "XPL-Intel"

xpl_intel-1.2.0/ingestion/cli.py

@@ -0,0 +1,162 @@
+"""XPL-Intel CLI — CVE ingestion pipeline."""
+
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+from datetime import datetime, timezone
+
+import argcomplete
+
+from ingestion import PRODUCT, __version__
+from schemas.advisory_v1 import Advisory
+
+ALL_SOURCES = ["kev", "nvd", "watchtowr", "nuclei", "exploitdb", "vulncheck", "ghsa"]
+OUTPUT_FORMATS = ["json", "sqlite", "csv"]
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="xpl-intel",
+        description=f"{PRODUCT} v{__version__} — CVE ingestion pipeline",
+    )
+    parser.add_argument("--version", action="version", version=f"{PRODUCT} {__version__}")
+
+    sub = parser.add_subparsers(dest="command")
+
+    ingest_p = sub.add_parser("ingest", help="Run ingestion from sources")
+    ingest_p.add_argument("--sources", "-s", nargs="+",
+                          choices=[*ALL_SOURCES, "all"],
+                          default=["all"])
+    ingest_p.add_argument("--nvd-key", help="NVD API key (optional)")
+    ingest_p.add_argument("--nvd-days", type=int, default=7, help="NVD lookback days")
+    ingest_p.add_argument("--nuclei-dir", default="nuclei-templates", help="Nuclei templates dir")
+    ingest_p.add_argument("--exploitdb-csv", help="ExploitDB CSV path")
+    ingest_p.add_argument("--vulncheck-token", help="VulnCheck API token")
+    ingest_p.add_argument("--github-token", help="GitHub token for GHSA")
+    ingest_p.add_argument("--ghsa-severity", default="critical,high",
+                          help="GHSA severity filter (default: critical,high)")
+    ingest_p.add_argument("--ghsa-days", type=int, default=7, help="GHSA lookback days")
+    ingest_p.add_argument("--output", "-o", default="output", help="Output directory")
+    ingest_p.add_argument("--format", "-f", nargs="+",
+                          choices=OUTPUT_FORMATS, default=["json"],
+                          help="Output formats (default: json)")
+
+    sub.add_parser("sources", help="List available sources")
+
+    argcomplete.autocomplete(parser)
+    args = parser.parse_args(argv)
+    if not args.command:
+        parser.print_help()
+        return 0
+
+    if args.command == "sources":
+        _print_sources()
+        return 0
+
+    return _run_ingest(args)
+
+
+def _print_sources() -> None:
+    sources = [
+        ("kev", "CISA KEV catalog (CSV daily)", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"),
+        ("nvd", "NVD API v2 (delta weekly)", "https://nvd.nist.gov/"),
+        ("watchtowr", "watchTowr Labs RSS", "https://labs.watchtowr.com/"),
+        ("nuclei", "Nuclei templates (local)", "https://github.com/projectdiscovery/nuclei-templates"),
+        ("exploitdb", "ExploitDB CSV (searchsploit)", "https://www.exploit-db.com/"),
+        ("vulncheck", "VulnCheck KEV enriched", "https://vulncheck.com/"),
+        ("ghsa", "GitHub Advisory Database", "https://github.com/advisories"),
+    ]
+    print(f"{PRODUCT} v{__version__} — Available sources:\n")
+    for name, desc, url in sources:
+        print(f"  {name:12s} {desc}")
+        print(f"  {'':12s} {url}")
+        print()
+
+
+def _run_ingest(args: argparse.Namespace) -> int:
+    from ingestion.dedup import deduplicate
+
+    sources_to_run: list[str] = args.sources
+    if "all" in sources_to_run:
+        sources_to_run = list(ALL_SOURCES)
+
+    all_advisories: list[Advisory] = []
+
+    for source in sources_to_run:
+        try:
+            advisories = _fetch_source(source, args)
+            print(f"[+] {source}: {len(advisories)} advisories")
+            all_advisories.extend(advisories)
+        except Exception as exc:
+            print(f"[-] {source}: {exc}", file=sys.stderr)
+
+    if not all_advisories:
+        print("[*] No advisories ingested")
+        return 0
+
+    deduped = deduplicate(all_advisories)
+    print(f"[+] Deduplicated: {len(all_advisories)} → {len(deduped)}")
+
+    os.makedirs(args.output, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y-%m-%d")
+
+    formats: list[str] = args.format
+    for fmt in formats:
+        _write_output(deduped, args.output, ts, fmt)
+
+    return 0
+
+
+def _write_output(advisories: list[Advisory], output_dir: str, ts: str, fmt: str) -> None:
+    if fmt == "json":
+        from ingestion.output.json_writer import write_json
+        path = write_json(advisories, os.path.join(output_dir, f"advisories-{ts}.json"))
+    elif fmt == "sqlite":
+        from ingestion.output.sqlite_writer import write_sqlite
+        path = write_sqlite(advisories, os.path.join(output_dir, f"advisories-{ts}.db"))
+    elif fmt == "csv":
+        from ingestion.output.csv_writer import write_csv
+        path = write_csv(advisories, os.path.join(output_dir, f"advisories-{ts}.csv"))
+    else:
+        print(f"[-] Unknown format: {fmt}", file=sys.stderr)
+        return
+    print(f"[+] Output ({fmt}): {path} ({len(advisories)} advisories)")
+
+
+def _fetch_source(source: str, args: argparse.Namespace) -> list[Advisory]:
+    if source == "kev":
+        from ingestion.sources.cisa_kev import fetch as fetch_kev
+        return fetch_kev()
+    if source == "nvd":
+        from ingestion.sources.nvd_api import fetch as fetch_nvd
+        return fetch_nvd(days_back=args.nvd_days, api_key=args.nvd_key)
+    if source == "watchtowr":
+        from ingestion.sources.watchtowr_rss import fetch as fetch_watchtowr
+        return fetch_watchtowr()
+    if source == "nuclei":
+        from ingestion.sources.nuclei_templates import fetch as fetch_nuclei
+        return fetch_nuclei(templates_dir=args.nuclei_dir)
+    if source == "exploitdb":
+        from ingestion.sources.exploitdb import fetch as fetch_exploitdb
+        return fetch_exploitdb(csv_path=args.exploitdb_csv)
+    if source == "vulncheck":
+        from ingestion.sources.vulncheck_kev import fetch as fetch_vulncheck
+        token = args.vulncheck_token or os.environ.get("VULNCHECK_TOKEN", "")
+        if not token:
+            raise ValueError("VulnCheck API token required (--vulncheck-token or VULNCHECK_TOKEN env)")
+        return fetch_vulncheck(api_token=token)
+    if source == "ghsa":
+        from ingestion.sources.github_advisory import fetch as fetch_ghsa
+        token = args.github_token or os.environ.get("GITHUB_TOKEN")
+        return fetch_ghsa(
+            days_back=args.ghsa_days,
+            github_token=token,
+            severity=args.ghsa_severity,
+        )
+    return []
+
+
+if __name__ == "__main__":
+    sys.exit(main())

xpl_intel-1.2.0/ingestion/dedup.py

@@ -0,0 +1,49 @@
+"""Deduplication engine — merge advisories by CVE+CNA, keep richest data."""
+
+from __future__ import annotations
+
+from schemas.advisory_v1 import Advisory
+
+
+def deduplicate(advisories: list[Advisory]) -> list[Advisory]:
+    seen: dict[str, Advisory] = {}
+
+    for adv in advisories:
+        key = adv.cve_id
+        if key in seen:
+            seen[key] = _merge(seen[key], adv)
+        else:
+            seen[key] = adv
+
+    return sorted(seen.values(), key=lambda a: a.cve_id)
+
+
+def _merge(existing: Advisory, new: Advisory) -> Advisory:
+    if not existing.description and new.description:
+        existing.description = new.description
+    if new.cvss_score is not None and (existing.cvss_score is None or new.cvss_score > existing.cvss_score):
+        existing.cvss_score = new.cvss_score
+        existing.cvss_vector = new.cvss_vector or existing.cvss_vector
+    if new.epss_score is not None:
+        existing.epss_score = new.epss_score
+        existing.epss_percentile = new.epss_percentile
+    if new.kev:
+        existing.kev = True
+        existing.kev_date_added = new.kev_date_added or existing.kev_date_added
+        existing.kev_due_date = new.kev_due_date or existing.kev_due_date
+    if not existing.vendor and new.vendor:
+        existing.vendor = new.vendor
+    if not existing.product and new.product:
+        existing.product = new.product
+    if new.cwe and not existing.cwe:
+        existing.cwe = new.cwe
+
+    existing.references = list(dict.fromkeys(existing.references + new.references))[:20]
+    existing.poc_urls = list(dict.fromkeys(existing.poc_urls + new.poc_urls))[:10]
+    existing.tags = list(dict.fromkeys(existing.tags + new.tags))[:20]
+    existing.mitre_techniques = list(dict.fromkeys(existing.mitre_techniques + new.mitre_techniques))
+
+    sources = f"{existing.source},{new.source}"
+    existing.source = ",".join(dict.fromkeys(sources.split(",")))
+
+    return existing

xpl_intel-1.2.0/ingestion/output/__init__.py

@@ -0,0 +1,9 @@
+"""Output writers for xpl-intel advisories."""
+
+from __future__ import annotations
+
+from ingestion.output.csv_writer import write_csv
+from ingestion.output.json_writer import write_json
+from ingestion.output.sqlite_writer import write_sqlite
+
+__all__ = ["write_csv", "write_json", "write_sqlite"]

xpl_intel-1.2.0/ingestion/output/csv_writer.py

@@ -0,0 +1,36 @@
+"""CSV output writer for xpl-intel advisories."""
+
+from __future__ import annotations
+
+import csv
+import json
+from pathlib import Path
+
+from schemas.advisory_v1 import Advisory
+
+CSV_FIELDS = [
+    "cve_id", "title", "description", "cvss_score", "cvss_vector",
+    "epss_score", "epss_percentile", "kev", "kev_date_added", "kev_due_date",
+    "vendor", "product", "affected_versions", "fixed_versions", "patch_url",
+    "poc_urls", "references", "cwe", "source", "source_url",
+    "status", "ingested_at", "mitre_techniques", "tags",
+]
+
+
+def write_csv(advisories: list[Advisory], path: str | Path) -> Path:
+    out = Path(path)
+    out.parent.mkdir(parents=True, exist_ok=True)
+
+    with open(out, "w", newline="", encoding="utf-8") as fh:
+        writer = csv.DictWriter(fh, fieldnames=CSV_FIELDS)
+        writer.writeheader()
+        for adv in advisories:
+            row = adv.to_dict()
+            row.pop("schema", None)
+            for key in ("affected_versions", "fixed_versions", "poc_urls",
+                        "references", "mitre_techniques", "tags"):
+                if isinstance(row.get(key), list):
+                    row[key] = json.dumps(row[key])
+            writer.writerow({k: row.get(k, "") for k in CSV_FIELDS})
+
+    return out

xpl_intel-1.2.0/ingestion/output/json_writer.py

@@ -0,0 +1,17 @@
+"""JSON output writer."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+from schemas.advisory_v1 import Advisory
+
+
+def write_json(advisories: list[Advisory], path: str | Path) -> Path:
+    out = Path(path)
+    data: list[dict[str, Any]] = [a.to_dict() for a in advisories]
+    out.parent.mkdir(parents=True, exist_ok=True)
+    out.write_text(json.dumps(data, indent=2, default=str), encoding="utf-8")
+    return out

xpl_intel-1.2.0/ingestion/output/sqlite_writer.py

@@ -0,0 +1,116 @@
+"""SQLite output writer for xpl-intel advisories."""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+from pathlib import Path
+
+from schemas.advisory_v1 import Advisory
+
+SCHEMA_SQL = """
+CREATE TABLE IF NOT EXISTS advisories (
+    cve_id TEXT PRIMARY KEY,
+    title TEXT NOT NULL,
+    description TEXT DEFAULT '',
+    cvss_score REAL,
+    cvss_vector TEXT DEFAULT '',
+    epss_score REAL,
+    epss_percentile REAL,
+    kev INTEGER DEFAULT 0,
+    kev_date_added TEXT,
+    kev_due_date TEXT,
+    vendor TEXT DEFAULT '',
+    product TEXT DEFAULT '',
+    affected_versions TEXT DEFAULT '[]',
+    fixed_versions TEXT DEFAULT '[]',
+    patch_url TEXT DEFAULT '',
+    poc_urls TEXT DEFAULT '[]',
+    "references" TEXT DEFAULT '[]',
+    cwe TEXT DEFAULT '',
+    source TEXT DEFAULT '',
+    source_url TEXT DEFAULT '',
+    status TEXT DEFAULT 'unverified',
+    ingested_at TEXT DEFAULT '',
+    mitre_techniques TEXT DEFAULT '[]',
+    tags TEXT DEFAULT '[]'
+);
+CREATE INDEX IF NOT EXISTS idx_advisories_vendor ON advisories(vendor);
+CREATE INDEX IF NOT EXISTS idx_advisories_cvss ON advisories(cvss_score);
+CREATE INDEX IF NOT EXISTS idx_advisories_kev ON advisories(kev);
+CREATE INDEX IF NOT EXISTS idx_advisories_source ON advisories(source);
+"""
+
+UPSERT_SQL = """
+INSERT INTO advisories (
+    cve_id, title, description, cvss_score, cvss_vector,
+    epss_score, epss_percentile, kev, kev_date_added, kev_due_date,
+    vendor, product, affected_versions, fixed_versions, patch_url,
+    poc_urls, "references", cwe, source, source_url,
+    status, ingested_at, mitre_techniques, tags
+) VALUES (
+    ?, ?, ?, ?, ?,
+    ?, ?, ?, ?, ?,
+    ?, ?, ?, ?, ?,
+    ?, ?, ?, ?, ?,
+    ?, ?, ?, ?
+) ON CONFLICT(cve_id) DO UPDATE SET
+    title = CASE WHEN excluded.title != '' THEN excluded.title ELSE advisories.title END,
+    description = CASE WHEN excluded.description != '' THEN excluded.description ELSE advisories.description END,
+    cvss_score = CASE WHEN excluded.cvss_score IS NOT NULL THEN excluded.cvss_score ELSE advisories.cvss_score END,
+    cvss_vector = CASE WHEN excluded.cvss_vector != '' THEN excluded.cvss_vector ELSE advisories.cvss_vector END,
+    kev = MAX(advisories.kev, excluded.kev),
+    source = advisories.source || ',' || excluded.source,
+    ingested_at = excluded.ingested_at
+"""
+
+
+def write_sqlite(advisories: list[Advisory], path: str | Path) -> Path:
+    out = Path(path)
+    out.parent.mkdir(parents=True, exist_ok=True)
+
+    conn = sqlite3.connect(str(out))
+    try:
+        conn.executescript(SCHEMA_SQL)
+        rows = [_advisory_to_row(a) for a in advisories]
+        conn.executemany(UPSERT_SQL, rows)
+        conn.commit()
+    finally:
+        conn.close()
+
+    return out
+
+
+def _advisory_to_row(adv: Advisory) -> tuple[
+    str, str, str, float | None, str,
+    float | None, float | None, int, str | None, str | None,
+    str, str, str, str, str,
+    str, str, str, str, str,
+    str, str, str, str,
+]:
+    return (
+        adv.cve_id,
+        adv.title,
+        adv.description,
+        adv.cvss_score,
+        adv.cvss_vector,
+        adv.epss_score,
+        adv.epss_percentile,
+        1 if adv.kev else 0,
+        adv.kev_date_added,
+        adv.kev_due_date,
+        adv.vendor,
+        adv.product,
+        json.dumps(adv.affected_versions),
+        json.dumps(adv.fixed_versions),
+        adv.patch_url,
+        json.dumps(adv.poc_urls),
+        json.dumps(adv.references),
+        adv.cwe,
+        adv.source,
+        adv.source_url,
+        adv.status,
+        adv.ingested_at,
+        json.dumps(adv.mitre_techniques),
+        json.dumps(adv.tags),
+    )

xpl_intel-1.2.0/ingestion/sources/cisa_kev.py

@@ -0,0 +1,44 @@
+"""CISA Known Exploited Vulnerabilities (KEV) catalog ingestion."""
+
+from __future__ import annotations
+
+import csv
+import io
+from datetime import datetime, timezone
+
+import requests
+
+from schemas.advisory_v1 import Advisory
+
+KEV_URL = "https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv"
+
+
+def fetch(timeout: int = 30) -> list[Advisory]:
+    resp = requests.get(KEV_URL, timeout=timeout)
+    resp.raise_for_status()
+
+    reader = csv.DictReader(io.StringIO(resp.text))
+    advisories = []
+    now = datetime.now(timezone.utc).isoformat()
+
+    for row in reader:
+        adv = Advisory(
+            cve_id=row.get("cveID", ""),
+            title=row.get("vulnerabilityName", ""),
+            description=row.get("shortDescription", ""),
+            vendor=row.get("vendorProject", ""),
+            product=row.get("product", ""),
+            kev=True,
+            kev_date_added=row.get("dateAdded", ""),
+            kev_due_date=row.get("dueDate", ""),
+            references=[row["notes"]] if row.get("notes") else [],
+            source="cisa_kev",
+            source_url=KEV_URL,
+            status="unverified",
+            ingested_at=now,
+            tags=["kev", "actively-exploited"],
+        )
+        if adv.cve_id:
+            advisories.append(adv)
+
+    return advisories