Prioritizes CVE fixes using CISA KEV catalog, EPSS scores, and CVSS ratings based on real-world exploitation evidence. Useful for vulnerability management workflows.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
CISA 已知被利用漏洞（KEV，Known Exploited Vulnerabilities）目录由约束性操作指令（BOD，Binding Operational Directive）22-01 建立，是一份持续更新的 CVE 列表，记录了已在现实环境中被主动利用、具有重大风险的漏洞。截至 2026 年初，该目录已包含超过 1,484 条记录，仅 2025 年就新增了 245 条，增长约 20%。本技能涵盖将 KEV 目录与 EPSS（漏洞利用预测评分系统，Exploit Prediction Scoring System）和 CVSS 整合到漏洞优先级工作流中，创建基于风险的方法，将已确认利用活动的漏洞优先级置于单纯理论严重性之上。
Prioritizes CVE remediation using CISA KEV catalog, EPSS, and CVSS scores based on real-world exploitation evidence. For security assessments and vulnerability management workflows.
Prioritizes CVE remediation using CISA KEV catalog for exploited vulns, EPSS prediction scores, CVSS severity, asset criticality, and exposure.
Manages vulnerability lifecycle: tracks CVEs, scores with CVSS, prioritizes risks using EPSS/KEV, designs remediation workflows, patch management, and disclosure practices.
Share bugs, ideas, or general feedback.
CISA 已知被利用漏洞（KEV，Known Exploited Vulnerabilities）目录由约束性操作指令（BOD，Binding Operational Directive）22-01 建立，是一份持续更新的 CVE 列表，记录了已在现实环境中被主动利用、具有重大风险的漏洞。截至 2026 年初，该目录已包含超过 1,484 条记录，仅 2025 年就新增了 245 条，增长约 20%。本技能涵盖将 KEV 目录与 EPSS（漏洞利用预测评分系统，Exploit Prediction Scoring System）和 CVSS 整合到漏洞优先级工作流中，创建基于风险的方法，将已确认利用活动的漏洞优先级置于单纯理论严重性之上。
每个 KEV 条目包含：
| CVE 发布日期 | 修复截止时间 |
|---|---|
| 2021 年或之后 | 列入 KEV 后 2 周 |
| 2021 年之前 | 列入 KEV 后 6 个月 |
| 因素 | 权重 | 数据来源 | 理由 |
|---|---|---|---|
| CISA KEV 收录 | 30% | CISA KEV JSON 数据源 | 已确认主动利用 |
| EPSS 评分 | 25% | FIRST EPSS API | 预测漏洞利用概率 |
| CVSS 基础分 | 20% | NVD API v2.0 | 漏洞固有严重性 |
| 资产关键性 | 15% | CMDB/资产清单 | 业务影响背景 |
| 网络暴露程度 | 10% | 网络架构 | 攻击面可访问性 |
| KEV 收录 | EPSS > 0.5 | CVSS >= 9.0 | 优先级 | SLA |
|---|---|---|---|---|
| 是 | 任意 | 任意 | P1-紧急 | 48 小时 |
| 否 | 是 | 是 | P1-紧急 | 48 小时 |
| 否 | 是 | 否 | P2-严重 | 7 天 |
| 否 | 否 | 是 | P2-严重 | 7 天 |
| 否 | 否 | 否（>= 7.0） | P3-高危 | 14 天 |
| 否 | 否 | 否（>= 4.0） | P4-中危 | 30 天 |
| 否 | 否 | 否（< 4.0） | P5-低危 | 90 天 |
import requests
import json
from datetime import datetime
KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
def fetch_kev_catalog():
"""下载并解析 CISA KEV 目录。"""
response = requests.get(KEV_URL, timeout=30)
response.raise_for_status()
data = response.json()
catalog = {}
for vuln in data.get("vulnerabilities", []):
cve_id = vuln["cveID"]
catalog[cve_id] = {
"vendor": vuln.get("vendorProject", ""),
"product": vuln.get("product", ""),
"name": vuln.get("vulnerabilityName", ""),
"date_added": vuln.get("dateAdded", ""),
"description": vuln.get("shortDescription", ""),
"action": vuln.get("requiredAction", ""),
"due_date": vuln.get("dueDate", ""),
"ransomware_use": vuln.get("knownRansomwareCampaignUse", "Unknown"),
}
print(f"[+] 已从 CISA KEV 目录加载 {len(catalog)} 个 CVE")
print(f" 目录版本：{data.get('catalogVersion', 'N/A')}")
print(f" 最后更新：{data.get('dateReleased', 'N/A')}")
return catalog
kev = fetch_kev_catalog()
EPSS_API = "https://api.first.org/data/v1/epss"
def get_epss_scores(cve_list):
"""批量获取一组 CVE 的 EPSS 评分。"""
scores = {}
batch_size = 100
for i in range(0, len(cve_list), batch_size):
batch = cve_list[i:i + batch_size]
cve_param = ",".join(batch)
response = requests.get(EPSS_API, params={"cve": cve_param}, timeout=30)
if response.status_code == 200:
for entry in response.json().get("data", []):
scores[entry["cve"]] = {
"epss": float(entry.get("epss", 0)),
"percentile": float(entry.get("percentile", 0)),
}
return scores
import pandas as pd
def prioritize_vulnerabilities(scan_results, kev_catalog, epss_scores):
"""对扫描结果应用多因素优先级排序。"""
prioritized = []
for vuln in scan_results:
cve_id = vuln.get("cve_id", "")
cvss_score = float(vuln.get("cvss_score", 0))
asset_criticality = float(vuln.get("asset_criticality", 3))
exposure = float(vuln.get("network_exposure", 3))
in_kev = cve_id in kev_catalog
kev_data = kev_catalog.get(cve_id, {})
epss_data = epss_scores.get(cve_id, {"epss": 0, "percentile": 0})
epss_score = epss_data["epss"]
# 综合风险分计算
risk_score = (
(1.0 if in_kev else 0.0) * 10 * 0.30 +
epss_score * 10 * 0.25 +
cvss_score * 0.20 +
(asset_criticality / 5.0) * 10 * 0.15 +
(exposure / 5.0) * 10 * 0.10
)
# 分配优先级
if in_kev or (epss_score > 0.5 and cvss_score >= 9.0):
priority = "P1-紧急"
sla_days = 2
elif epss_score > 0.5 or cvss_score >= 9.0:
priority = "P2-严重"
sla_days = 7
elif cvss_score >= 7.0:
priority = "P3-高危"
sla_days = 14
elif cvss_score >= 4.0:
priority = "P4-中危"
sla_days = 30
else:
priority = "P5-低危"
sla_days = 90
prioritized.append({
"cve_id": cve_id,
"cvss_score": cvss_score,
"epss_score": round(epss_score, 4),
"epss_percentile": round(epss_data["percentile"], 4),
"in_cisa_kev": in_kev,
"ransomware_use": kev_data.get("ransomware_use", "N/A"),
"kev_due_date": kev_data.get("due_date", "N/A"),
"risk_score": round(risk_score, 2),
"priority": priority,
"sla_days": sla_days,
"asset": vuln.get("asset", ""),
"asset_criticality": asset_criticality,
})
df = pd.DataFrame(prioritized)
df = df.sort_values("risk_score", ascending=False)
return df
def generate_report(df, output_file="kev_prioritized_report.csv"):
"""从优先级排序的漏洞数据生成摘要报告。"""
print("\n" + "=" * 70)
print("漏洞优先级排序报告 — KEV + EPSS + CVSS")
print("=" * 70)
print(f"\n已分析漏洞总数：{len(df)}")
print(f"KEV 收录的漏洞：{df['in_cisa_kev'].sum()}")
print(f"与勒索软件关联：{(df['ransomware_use'] == 'Known').sum()}")
print("\n优先级分布：")
print(df["priority"].value_counts().to_string())
print("\n前 15 个高风险漏洞：")
top = df.head(15)[["cve_id", "cvss_score", "epss_score", "in_cisa_kev",
"risk_score", "priority"]]
print(top.to_string(index=False))
df.to_csv(output_file, index=False)
print(f"\n[+] 完整报告已保存到：{output_file}")