{"id":19883632,"url":"https://github.com/muchdogesec/cve2stix","last_synced_at":"2025-05-02T14:33:45.766Z","repository":{"id":243037010,"uuid":"809769871","full_name":"muchdogesec/cve2stix","owner":"muchdogesec","description":"A command line tool that turns NVD CVE records into STIX 2.1 Objects.","archived":false,"fork":false,"pushed_at":"2025-03-25T12:41:05.000Z","size":429,"stargazers_count":11,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-04-07T02:51:13.306Z","etag":null,"topics":["cve","nvd","stix2","stix2-patterns","vulnerability"],"latest_commit_sha":null,"homepage":"https://www.dogesec.com/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/muchdogesec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-03T12:19:28.000Z","updated_at":"2025-03-25T12:41:06.000Z","dependencies_parsed_at":null,"dependency_job_id":"96827a87-63e9-4999-9387-039ea3861137","html_url":"https://github.com/muchdogesec/cve2stix","commit_stats":null,"previous_names":["muchdogesec/cve2stix"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/muchdogesec%2Fcve2stix","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/muchdogesec%2Fcve2stix/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/muchdogesec%2Fcve2stix/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/muchdogesec%2Fcve2stix/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/muchdogesec","download_url":"https://codeload.github.com/muchdogesec/cve2stix/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252053936,"owners_count":21687196,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve","nvd","stix2","stix2-patterns","vulnerability"],"created_at":"2024-11-12T17:21:42.205Z","updated_at":"2025-05-02T14:33:45.760Z","avatar_url":"https://github.com/muchdogesec.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cve2stix\n\n## Before you begin\n\nWe host a full web API that includes all objects created by cve2stix, [Vulmatch](https://www.vulmatch.com/).\n\n## Overview\n\n![](docs/cve2stix.png)\n\nA command line tool that turns NVD CVE records into STIX 2.1 Objects.\n\n\u003e The mission of the CVE® Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. There is one CVE Record for each vulnerability in the catalog. The vulnerabilities are discovered then assigned and published by organizations from around the world that have partnered with the CVE Program. Partners publish CVE Records to communicate consistent descriptions of vulnerabilities. Information technology and cybersecurity professionals use CVE Records to ensure they are discussing the same issue, and to coordinate their efforts to prioritize and address the vulnerabilities.\n\nSource: https://www.cve.org/About/Overview\n\nCVE records are currently published to the NVD API, but are in a custom schema.\n\nWe had a requirement to have an up-to-date copy of NVD CVEs in STIX 2.1 format for easy dissemination to downstream system.\n\nThe code in this repository turns CVEs into STIX 2.1 objects, and keeps them updated to match the official CVE API;\n\n1. Downloads the current CVEs (that match a users filters) from an [NVD API mirror](https://github.com/espressif/esp-nvd-mirror/)\n2. Converts them to STIX 2.1 Objects\n3. Stores the STIX 2.1 Objects in the file store\n4. Creates STIX Bundles of generated objects for each update run\n\n## tl;dr\n\n[![cve2stix](https://img.youtube.com/vi/j8DWB7QF95g/0.jpg)](https://www.youtube.com/watch?v=j8DWB7QF95g)\n\n[Watch the demo](https://www.youtube.com/watch?v=j8DWB7QF95g).\n\n## Install the script\n\n```shell\n# clone the latest code\ngit clone https://github.com/muchdogesec/cve2stix\n# create a venv\ncd cve2stix\npython3 -m venv cve2stix-venv\nsource cve2stix-venv/bin/activate\n# install requirements\npip3 install -r requirements.txt\n```\n\nYou will also need to have redis installed on your machine. [Instructions to do this are here](https://redis.io/docs/getting-started/installation/).\n\nIf you're on Mac, like me, the easiest way to do this is;\n\n```shell\nbrew install redis\n```\n\n### Configuration options\n\ncve2stix has various settings that are defined in an `.env` file.\n\nTo create a template for the file:\n\n```shell\ncp .env.example .env\n```\n\nTo see more information about how to set the variables, and what they do, read the `.env.markdown` file.\n\n## Running the script\n\nThe script to get CVEs can now be executed (in the second terminal window) using;\n\n```shell\npython3 cve2stix.py MODE \\\n    --earliest date \\\n    --latest date \\\n    --file_time_range dictionary\n```\n\n* `MODE`: either\n    * `mod`: uses modified date for `--earliest` and `--latest` flags (recommended for daily updates)\n    * `pub`: uses published date for `--earliest` and `--latest` flags (recommended for backfill -- see note later)\n* `earliest` (required, date in format `YYYY-MM-DDThh:mm:ss`): earliest datetime you want\n* `latest` (required, date in format `YYYY-MM-DDThh:mm:ss`): latest datetime you want\n* `file_time_range` (required): defines how much data should be packed in each output bundle. Use `d` for days, `m` for months, `y` for years. Note, if no results are found for a time period, a bundle will not be generated. This usually explains why you see \"missing\" bundles for a day or month. \n    * default `1m` (1 month)\n\nIMPORTANT: if the time between `--earliest` and `--latest` is greater than 120 days and you select `--file_time_range` = `1y`, the script will batch celery jobs with different `lastModStartDate` and `lastModEndDate` as NVD only allows for a range of 120 days to be specified in a request.\n\ne.g. get all cves with modified times that are in the first week of December 2024 (and place into daily bundles)\n\n```shell\npython3 cve2stix.py \\\n    mod \\\n    --earliest 2024-12-01T00:00:00 \\\n    --latest 2024-12-07T23:59:59 \\\n    --file_time_range 1d\n```\n\nWill generate bundle files in directories as follows:\n\n```txt\noutput\n└── bundles\n    ├── cve-bundle-2024_12_01-00_00_00-2024_08_01-23_59_59.json\n    ├── cve-bundle-2024_12_02-00_00_00-2024_08_02-23_59_59.json\n    ├── cve-bundle-2024_12_03-00_00_00-2024_08_03-23_59_59.json\n    ├── ...\n```\n\nNote, it is possible to have missing gaps in the data. This just means no CVE had a modified time between that time range. This is especially true when running across larger periods of time.\n\n### IMPORTANT NOTE ON BACKFILLING DATA\n\nBetween 2024-11-19 and 2024-11-21 most of the NVD dataset was modified as part of adding support for ADP data.\n\nYou can read more about this at https://www.nist.gov/itl/nvd#november1524.\n\nThis is problematic for us, as will result in huge bundles using `mod` mode.\n\nAs such, we have build in the `pub` to handle this data more graciously. Because the `pubDate` are more spread out, the resulting will be more manageable sizes. \n\nRecommended backfill (to end of December 2024);\n\n```shell\npython3 cve2stix.py \\\n    pub \\\n    --earliest 1988-10-01T00:00:00 \\\n    --latest 2024-12-31T23:59:59 \\\n    --file_time_range 1d\n```\n\n(earliest CVE, CVE-1999-0095 was published `1988-10-01T04:00:00.000`).\n\n## Useful supporting tools\n\n* To generate STIX 2.1 Objects: [stix2 Python Lib](https://stix2.readthedocs.io/en/latest/)\n* The STIX 2.1 specification: [STIX 2.1 docs](https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html)\n* [NVD CVE Overview](https://nvd.nist.gov/vuln)\n* [NVD CVE API](https://nvd.nist.gov/developers/vulnerabilities)\n\n## Support\n\n[Minimal support provided via the DOGESEC community](https://community.dogesec.com/).\n\n## License\n\n[Apache 2.0](/LICENSE).","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmuchdogesec%2Fcve2stix","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmuchdogesec%2Fcve2stix","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmuchdogesec%2Fcve2stix/lists"}