Mine SCCM and NIST NVD for host vulnerability data
Project description
Vulnmine uses simple Machine Learning to mine Microsoft’s SCCM host and software inventory data for vulnerable 3rd-party software.
NIST’s NVD vulnerability feeds are pulled in on a daily basis to determine the latest vulnerabilities to search for.
Running Vulnmine
There is a public container with test data ready for use on Docker Hub: lorgor/vulnmine
To download and run the Vulnmine container:
docker run -it --rm lorgor/vulnmine bash
python src/vulnmine.py -a 'all'
Commandline Start Options
Here are the possible options when starting Vulnmine:
vulnmine.py [-h] [--version] [-l Logging] [-a Action] [-y Years] [-w Workdir] -h --help Help information -l --loglevel Set desired verbosity for logging ('debug','info','warning','error','critical') -a --action Desired action to perform ('rd_sccm_hosts','rd_sccm_sft','rd_cpe','rd_cve', 'match_vendors','match_sft','upd_hosts_vulns','output_stats') -y --years Number of yrs of CVE files to download -w --workdir Working directory
Production mode
If no parameters are specified, then Vulnmine runs in production mode:
The main vulnmine.py starts and sets up an endless schedule loop.
The loop fires once daily by default.
Each day Vulnmine:
Reads the SCCM inventory data files (UTF16 csv format) in the its CSV directory.
Downloads updated NVD feed files.
Processes the SCCM and NVD data.
Produces output JSON files into the same csv directory.
Where to get more information
Vulnmine is on Github: https://github.com/lorgor/vulnmine
The docs directory has the full Vulnmine documentation.
Project details
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.