PSIRT Automation

[ryansharpe]

Hello,

I'm looking to create some automation between PSIRTs and our ITSM processes. The script I'm writing is having issues filtering on the FirstPublished attribute.

from openVulnQuery import query_client
Client = query_client.OpenVulnQueryClient(client_id="xxxxxxxxxxxxxx", client_secret="xxxxxxxxxxxxxxxxxxxxxxx")
advisories = Client.get_by_severity(FirstPublished('2018-01-01', '2018-05-15'), adv_format='cvrf', severity='high' )

for i in advisories:
  print i.advisory_id
  print i.advisory_title
  print i.sir
  print i.cves

It produces the error:

Traceback (most recent call last):
  File "getVuln2.py", line 5, in <module>
    advisories = Client.get_by_severity(FirstPublished('2018-01-01', '2018-05-15'), adv_format='cvrf', severity='high' )
NameError: name 'FirstPublished' is not defined

The example here: https://github.com/CiscoPSIRT/openVulnAPI/tree/master/openVulnQuery has FirstPublished at the end of the arguments. When I execute it, it throws the error:

  File "getVuln2.py", line 5
    advisories = Client.get_by_severity(adv_format='cvrf', severity='high', FirstPublished('2018-01-01', '2018-05-15'))

I'm trying to go through the other various python files to determine how to add this filter, but I'm having a hard time deciphering it. I could write my own filter I suppose, but I'd rather not.

[ryansharpe · Accepted solution]

Found my problem the instance variable need to be set then call as an object.

client = query_client.OpenVulnQueryClient(client_id="xxxxx", client_secret="xxxxx")
filter = query_client.FirstPublishedFilter('2017-06-01', '2018-05-21')
advisories = client.get_by_all(adv_format='cvrf', all_adv='all', filter=filter)