#!/usr/bin/env python3
"""CISA KEV CVE prioritization agent.

Downloads the CISA Known Exploited Vulnerabilities (KEV) catalog and
cross-references it against a list of CVEs from vulnerability scans to
prioritize remediation based on active exploitation status, due dates,
and vendor/product impact.
"""
import argparse
import csv
import io
import json
import os
import sys
from datetime import datetime, timezone

try:
    import requests
except ImportError:
    print("[!] 'requests' library required: pip install requests", file=sys.stderr)
    sys.exit(1)

KEV_JSON_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"


def download_kev_catalog():
    """Download the latest CISA KEV catalog as JSON."""
    print(f"[*] Downloading CISA KEV catalog from {KEV_JSON_URL}")
    resp = requests.get(KEV_JSON_URL, timeout=30)
    resp.raise_for_status()
    data = resp.json()
    vulns = data.get("vulnerabilities", [])
    catalog_version = data.get("catalogVersion", "unknown")
    count = data.get("count", len(vulns))
    date_released = data.get("dateReleased", "unknown")
    print(f"[+] KEV catalog v{catalog_version}: {count} vulnerabilities "
          f"(released: {date_released})")
    return vulns, {
        "catalog_version": catalog_version,
        "count": count,
        "date_released": date_released,
    }


def build_kev_index(kev_vulns):
    """Build a lookup dict keyed by CVE ID for fast matching."""
    index = {}
    for vuln in kev_vulns:
        cve_id = vuln.get("cveID", "")
        if cve_id:
            index[cve_id.upper()] = {
                "cve_id": cve_id,
                "vendor": vuln.get("vendorProject", ""),
                "product": vuln.get("product", ""),
                "vulnerability_name": vuln.get("vulnerabilityName", ""),
                "date_added": vuln.get("dateAdded", ""),
                "short_description": vuln.get("shortDescription", ""),
                "required_action": vuln.get("requiredAction", ""),
                "due_date": vuln.get("dueDate", ""),
                "known_ransomware_campaign": vuln.get("knownRansomwareCampaignUse", "Unknown"),
                "notes": vuln.get("notes", ""),
            }
    return index


def load_cve_list(source):
    """Load CVE list from file (one CVE per line or CSV) or comma-separated string."""
    cves = []
    if os.path.isfile(source):
        with open(source, "r") as f:
            content = f.read()
        for line in content.strip().splitlines():
            line = line.strip().strip(",").strip('"')
            if line.upper().startswith("CVE-"):
                cves.append(line.upper())
            elif "," in line:
                parts = line.split(",")
                for part in parts:
                    part = part.strip().strip('"')
                    if part.upper().startswith("CVE-"):
                        cves.append(part.upper())
    else:
        for part in source.split(","):
            part = part.strip()
            if part.upper().startswith("CVE-"):
                cves.append(part.upper())
    return list(set(cves))


def prioritize_cves(cve_list, kev_index):
    """Cross-reference CVEs against KEV catalog and prioritize."""
    in_kev = []
    not_in_kev = []

    for cve_id in cve_list:
        kev_entry = kev_index.get(cve_id)
        if kev_entry:
            entry = dict(kev_entry)
            entry["in_kev"] = True
            entry["priority"] = "CRITICAL"
            if entry.get("known_ransomware_campaign", "").lower() == "known":
                entry["priority"] = "CRITICAL-RANSOMWARE"
            try:
                due = datetime.strptime(entry["due_date"], "%Y-%m-%d")
                if due < datetime.now():
                    entry["overdue"] = True
                    entry["priority"] = "CRITICAL-OVERDUE"
                else:
                    entry["overdue"] = False
            except (ValueError, KeyError):
                entry["overdue"] = False
            in_kev.append(entry)
        else:
            not_in_kev.append({
                "cve_id": cve_id,
                "in_kev": False,
                "priority": "STANDARD",
            })

    # Sort: overdue first, then ransomware, then by due date
    priority_order = {"CRITICAL-OVERDUE": 0, "CRITICAL-RANSOMWARE": 1, "CRITICAL": 2}
    in_kev.sort(key=lambda x: (priority_order.get(x["priority"], 9), x.get("due_date", "")))

    return in_kev, not_in_kev


def format_summary(in_kev, not_in_kev, total_cves, catalog_info):
    """Print a human-readable prioritization report."""
    print(f"\n{'='*60}")
    print(f"  CISA KEV CVE Prioritization Report")
    print(f"{'='*60}")
    print(f"  KEV Catalog  : v{catalog_info['catalog_version']} "
          f"({catalog_info['count']} total KEVs)")
    print(f"  Input CVEs   : {total_cves}")
    print(f"  In KEV       : {len(in_kev)} (actively exploited)")
    print(f"  Not in KEV   : {len(not_in_kev)}")

    overdue = [v for v in in_kev if v.get("overdue")]
    ransomware = [v for v in in_kev if "RANSOMWARE" in v.get("priority", "")]

    print(f"\n  Priority Breakdown:")
    print(f"    CRITICAL-OVERDUE     : {len(overdue)}")
    print(f"    CRITICAL-RANSOMWARE  : {len(ransomware)}")
    print(f"    CRITICAL (in KEV)    : {len(in_kev)}")
    print(f"    STANDARD (not in KEV): {len(not_in_kev)}")

    if in_kev:
        print(f"\n  KEV-Listed CVEs (prioritize remediation):")
        for v in in_kev[:20]:
            overdue_flag = " [OVERDUE]" if v.get("overdue") else ""
            ransomware_flag = " [RANSOMWARE]" if "RANSOMWARE" in v.get("priority", "") else ""
            print(f"    {v['cve_id']:18s} | Due: {v.get('due_date', 'N/A'):10s} | "
                  f"{v.get('vendor', ''):15s} | {v.get('product', ''):20s}"
                  f"{overdue_flag}{ransomware_flag}")
            if v.get("required_action"):
                print(f"      Action: {v['required_action'][:70]}")


def kev_stats(kev_vulns):
    """Compute statistics about the KEV catalog."""
    by_vendor = {}
    ransomware_count = 0
    for v in kev_vulns:
        vendor = v.get("vendorProject", "Unknown")
        by_vendor[vendor] = by_vendor.get(vendor, 0) + 1
        if v.get("knownRansomwareCampaignUse", "").lower() == "known":
            ransomware_count += 1

    print(f"\n  KEV Catalog Statistics:")
    print(f"    Total vulnerabilities  : {len(kev_vulns)}")
    print(f"    Ransomware-associated  : {ransomware_count}")
    print(f"    Top vendors:")
    for vendor, count in sorted(by_vendor.items(), key=lambda x: -x[1])[:10]:
        print(f"      {vendor:30s}: {count}")


def main():
    parser = argparse.ArgumentParser(
        description="CISA KEV CVE prioritization agent"
    )
    parser.add_argument("--cves", required=True,
                        help="CVE list: comma-separated string or path to file")
    parser.add_argument("--kev-file",
                        help="Path to local KEV JSON (skip download)")
    parser.add_argument("--stats", action="store_true",
                        help="Show KEV catalog statistics")
    parser.add_argument("--output", "-o", help="Output JSON report path")
    parser.add_argument("--verbose", "-v", action="store_true")
    args = parser.parse_args()

    if args.kev_file:
        print(f"[*] Loading local KEV file: {args.kev_file}")
        with open(args.kev_file, "r") as f:
            data = json.load(f)
        kev_vulns = data.get("vulnerabilities", [])
        catalog_info = {
            "catalog_version": data.get("catalogVersion", "local"),
            "count": len(kev_vulns),
            "date_released": data.get("dateReleased", "unknown"),
        }
    else:
        kev_vulns, catalog_info = download_kev_catalog()

    if args.stats:
        kev_stats(kev_vulns)

    kev_index = build_kev_index(kev_vulns)
    cve_list = load_cve_list(args.cves)
    print(f"[*] Loaded {len(cve_list)} CVE(s) to check")

    in_kev, not_in_kev = prioritize_cves(cve_list, kev_index)
    format_summary(in_kev, not_in_kev, len(cve_list), catalog_info)

    report = {
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "tool": "CISA KEV Prioritization",
        "catalog_info": catalog_info,
        "input_cve_count": len(cve_list),
        "kev_matched": len(in_kev),
        "kev_unmatched": len(not_in_kev),
        "prioritized": in_kev,
        "standard_priority": not_in_kev,
        "risk_level": (
            "CRITICAL" if any(v.get("overdue") for v in in_kev)
            else "HIGH" if in_kev
            else "LOW"
        ),
    }

    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"\n[+] Report saved to {args.output}")
    elif args.verbose:
        print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
CISA KEV-Based CVE Prioritization Engine

Fetches the CISA Known Exploited Vulnerabilities catalog,
enriches with EPSS scores, and prioritizes against scan results.

Requirements:
    pip install requests pandas

Usage:
    python process.py fetch                              # Download KEV catalog
    python process.py check --cve CVE-2024-3094          # Check single CVE
    python process.py prioritize --csv vulns.csv --output prioritized.csv
    python process.py stats                              # KEV catalog statistics
"""

import argparse
import json
import sys
from datetime import datetime, timedelta
from pathlib import Path

import pandas as pd
import requests


KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
EPSS_API = "https://api.first.org/data/v1/epss"
NVD_API = "https://services.nvd.nist.gov/rest/json/cves/2.0"
KEV_CACHE = "kev_catalog.json"


class KEVPrioritizer:
    """CISA KEV-based vulnerability prioritization engine."""

    def __init__(self):
        self.kev_catalog = {}
        self.session = requests.Session()
        self.session.headers.update({"User-Agent": "KEV-Prioritizer/1.0"})

    def fetch_kev(self, cache_file=KEV_CACHE):
        """Download and cache the KEV catalog."""
        print("[*] Fetching CISA KEV catalog...")
        response = self.session.get(KEV_URL, timeout=30)
        response.raise_for_status()
        data = response.json()

        for vuln in data.get("vulnerabilities", []):
            cve_id = vuln["cveID"]
            self.kev_catalog[cve_id] = {
                "vendor": vuln.get("vendorProject", ""),
                "product": vuln.get("product", ""),
                "name": vuln.get("vulnerabilityName", ""),
                "date_added": vuln.get("dateAdded", ""),
                "description": vuln.get("shortDescription", ""),
                "action": vuln.get("requiredAction", ""),
                "due_date": vuln.get("dueDate", ""),
                "ransomware_use": vuln.get("knownRansomwareCampaignUse", "Unknown"),
            }

        with open(cache_file, "w") as f:
            json.dump(data, f)

        print(f"[+] Loaded {len(self.kev_catalog)} CVEs from KEV catalog")
        print(f"    Version: {data.get('catalogVersion', 'N/A')}")
        print(f"    Released: {data.get('dateReleased', 'N/A')}")
        return self.kev_catalog

    def load_cached_kev(self, cache_file=KEV_CACHE):
        """Load KEV catalog from local cache."""
        if not Path(cache_file).exists():
            return self.fetch_kev(cache_file)

        with open(cache_file) as f:
            data = json.load(f)

        for vuln in data.get("vulnerabilities", []):
            cve_id = vuln["cveID"]
            self.kev_catalog[cve_id] = {
                "vendor": vuln.get("vendorProject", ""),
                "product": vuln.get("product", ""),
                "name": vuln.get("vulnerabilityName", ""),
                "date_added": vuln.get("dateAdded", ""),
                "description": vuln.get("shortDescription", ""),
                "action": vuln.get("requiredAction", ""),
                "due_date": vuln.get("dueDate", ""),
                "ransomware_use": vuln.get("knownRansomwareCampaignUse", "Unknown"),
            }
        print(f"[+] Loaded {len(self.kev_catalog)} CVEs from cache")
        return self.kev_catalog

    def get_epss_batch(self, cve_list):
        """Fetch EPSS scores for a batch of CVEs."""
        scores = {}
        batch_size = 100
        for i in range(0, len(cve_list), batch_size):
            batch = cve_list[i:i + batch_size]
            try:
                response = self.session.get(
                    EPSS_API, params={"cve": ",".join(batch)}, timeout=30
                )
                if response.status_code == 200:
                    for entry in response.json().get("data", []):
                        scores[entry["cve"]] = {
                            "epss": float(entry.get("epss", 0)),
                            "percentile": float(entry.get("percentile", 0)),
                        }
            except Exception as e:
                print(f"  [!] EPSS batch error: {e}")
        return scores

    def prioritize(self, vulnerabilities):
        """Prioritize vulnerabilities using KEV + EPSS + CVSS."""
        cve_list = [v.get("cve_id", "") for v in vulnerabilities if v.get("cve_id")]
        epss_scores = self.get_epss_batch(cve_list)

        results = []
        for vuln in vulnerabilities:
            cve_id = vuln.get("cve_id", "")
            cvss = float(vuln.get("cvss_score", 0))
            asset_crit = float(vuln.get("asset_criticality", 3))
            exposure = float(vuln.get("network_exposure", 3))

            in_kev = cve_id in self.kev_catalog
            kev_data = self.kev_catalog.get(cve_id, {})
            epss = epss_scores.get(cve_id, {"epss": 0, "percentile": 0})

            risk_score = (
                (1.0 if in_kev else 0.0) * 10 * 0.30 +
                epss["epss"] * 10 * 0.25 +
                cvss * 0.20 +
                (asset_crit / 5.0) * 10 * 0.15 +
                (exposure / 5.0) * 10 * 0.10
            )

            if in_kev or (epss["epss"] > 0.5 and cvss >= 9.0):
                priority, sla = "P1-Emergency", 2
            elif epss["epss"] > 0.5 or cvss >= 9.0:
                priority, sla = "P2-Critical", 7
            elif cvss >= 7.0:
                priority, sla = "P3-High", 14
            elif cvss >= 4.0:
                priority, sla = "P4-Medium", 30
            else:
                priority, sla = "P5-Low", 90

            results.append({
                **vuln,
                "in_cisa_kev": in_kev,
                "ransomware_use": kev_data.get("ransomware_use", "N/A"),
                "kev_due_date": kev_data.get("due_date", "N/A"),
                "epss_score": round(epss["epss"], 4),
                "epss_percentile": round(epss["percentile"], 4),
                "risk_score": round(risk_score, 2),
                "priority": priority,
                "sla_days": sla,
            })

        df = pd.DataFrame(results)
        return df.sort_values("risk_score", ascending=False)

    def check_cve(self, cve_id):
        """Check a single CVE against KEV and EPSS."""
        in_kev = cve_id in self.kev_catalog
        kev_data = self.kev_catalog.get(cve_id, {})
        epss = self.get_epss_batch([cve_id]).get(cve_id, {"epss": 0, "percentile": 0})

        print(f"\n{'=' * 60}")
        print(f"CVE:              {cve_id}")
        print(f"In CISA KEV:      {'YES' if in_kev else 'No'}")
        if in_kev:
            print(f"  Vendor:         {kev_data.get('vendor', 'N/A')}")
            print(f"  Product:        {kev_data.get('product', 'N/A')}")
            print(f"  Date Added:     {kev_data.get('date_added', 'N/A')}")
            print(f"  Due Date:       {kev_data.get('due_date', 'N/A')}")
            print(f"  Ransomware Use: {kev_data.get('ransomware_use', 'N/A')}")
            print(f"  Action:         {kev_data.get('action', 'N/A')}")
        print(f"EPSS Score:       {epss['epss']:.4f} ({epss['percentile'] * 100:.1f}th pct)")

    def catalog_stats(self):
        """Print KEV catalog statistics."""
        if not self.kev_catalog:
            print("[!] KEV catalog not loaded.")
            return

        df = pd.DataFrame(self.kev_catalog.values())

        print(f"\n{'=' * 60}")
        print(f"CISA KEV CATALOG STATISTICS")
        print(f"{'=' * 60}")
        print(f"Total CVEs: {len(self.kev_catalog)}")

        ransomware = df[df["ransomware_use"] == "Known"]
        print(f"Ransomware-associated: {len(ransomware)}")

        print(f"\nTop 10 Vendors:")
        print(df["vendor"].value_counts().head(10).to_string())

        df["date_added"] = pd.to_datetime(df["date_added"], errors="coerce")
        df["year_added"] = df["date_added"].dt.year
        print(f"\nAdditions by Year:")
        print(df["year_added"].value_counts().sort_index().to_string())


def main():
    parser = argparse.ArgumentParser(description="CISA KEV CVE Prioritization Engine")
    subparsers = parser.add_subparsers(dest="command")

    subparsers.add_parser("fetch", help="Download/update KEV catalog")
    subparsers.add_parser("stats", help="Show KEV catalog statistics")

    check_p = subparsers.add_parser("check", help="Check a single CVE")
    check_p.add_argument("--cve", required=True, help="CVE ID to check")

    pri_p = subparsers.add_parser("prioritize", help="Prioritize vulns from CSV")
    pri_p.add_argument("--csv", required=True, help="Input CSV (needs cve_id column)")
    pri_p.add_argument("--output", default="kev_prioritized.csv", help="Output CSV")

    args = parser.parse_args()
    engine = KEVPrioritizer()

    if args.command == "fetch":
        engine.fetch_kev()
    elif args.command == "stats":
        engine.load_cached_kev()
        engine.catalog_stats()
    elif args.command == "check":
        engine.load_cached_kev()
        engine.check_cve(args.cve)
    elif args.command == "prioritize":
        engine.load_cached_kev()
        df = pd.read_csv(args.csv)
        vulns = df.to_dict("records")
        result = engine.prioritize(vulns)
        result.to_csv(args.output, index=False)
        print(f"\n[+] Prioritized {len(result)} vulnerabilities to {args.output}")
        print(f"\nPriority Distribution:")
        print(result["priority"].value_counts().to_string())
    else:
        parser.print_help()


if __name__ == "__main__":
    main()