Vulnerability Report Analysis

This example demonstrates how to use CVE Utils to analyze security bulletins, vulnerability reports, and related documents.

Scenario Description

As a security team member, you need to:

• Extract CVE information from various security bulletins
• Analyze vulnerability time distribution and trends
• Generate statistical reports for management reference
• Identify vulnerabilities that need priority handling

Complete Example

1. Security Bulletin Analyzer

package main

import (
    "fmt"
    "github.com/scagogogo/cve"
)

type SecurityBulletin struct {
    ID          string
    Title       string
    Content     string
    PublishDate string
}

type VulnerabilityAnalyzer struct {
    bulletins []SecurityBulletin
}

func NewVulnerabilityAnalyzer() *VulnerabilityAnalyzer {
    return &VulnerabilityAnalyzer{
        bulletins: make([]SecurityBulletin, 0),
    }
}

func (va *VulnerabilityAnalyzer) AddBulletin(bulletin SecurityBulletin) {
    va.bulletins = append(va.bulletins, bulletin)
}

func (va *VulnerabilityAnalyzer) AnalyzeAll() map[string][]string {
    allCVEs := make(map[string][]string)
    
    for _, bulletin := range va.bulletins {
        cves := cve.ExtractCve(bulletin.Content)
        if len(cves) > 0 {
            allCVEs[bulletin.ID] = cves
        }
    }
    
    return allCVEs
}

func (va *VulnerabilityAnalyzer) GetStatistics() {
    allCVEs := va.AnalyzeAll()
    
    var totalCVEs []string
    for _, cves := range allCVEs {
        totalCVEs = append(totalCVEs, cves...)
    }
    
    // Remove duplicates and group by year
    uniqueCVEs := cve.RemoveDuplicateCves(totalCVEs)
    groupedByYear := cve.GroupByYear(uniqueCVEs)
    
    fmt.Printf("Total bulletins analyzed: %d\n", len(va.bulletins))
    fmt.Printf("Total unique CVEs found: %d\n", len(uniqueCVEs))
    fmt.Printf("CVEs by year: %v\n", groupedByYear)
}

func main() {
    analyzer := NewVulnerabilityAnalyzer()
    
    // Sample bulletins
    bulletins := []SecurityBulletin{
        {
            ID:      "BULL-001",
            Title:   "Critical Security Update",
            Content: "This update addresses CVE-2021-44228 and CVE-2022-12345",
        },
        {
            ID:      "BULL-002", 
            Title:   "Monthly Security Bulletin",
            Content: "Fixed vulnerabilities: CVE-2022-9999, CVE-2023-1234",
        },
    }
    
    for _, bulletin := range bulletins {
        analyzer.AddBulletin(bulletin)
    }
    
    analyzer.GetStatistics()
}

Analysis Features

1. CVE Extraction: Automatically extract CVEs from bulletin text
2. Deduplication: Remove duplicate CVEs across bulletins
3. Trend Analysis: Group CVEs by year for trend analysis
4. Statistical Reporting: Generate summary statistics

Best Practices

1. Validate extracted CVEs before analysis
2. Handle different text formats in bulletins
3. Consider date ranges for trend analysis
4. Cache results for large datasets