Stats
Actions
Tags
Prioritizes CVE fixes using CISA KEV catalog, EPSS scores, and CVSS ratings based on real-world exploitation evidence. Useful for vulnerability management workflows.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersecurity-skills-zh:performing-cve-prioritization-with-kev-catalogThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
CISA 已知被利用漏洞（KEV，Known Exploited Vulnerabilities）目录由约束性操作指令（BOD，Binding Operational Directive）22-01 建立，是一份持续更新的 CVE 列表，记录了已在现实环境中被主动利用、具有重大风险的漏洞。截至 2026 年初，该目录已包含超过 1,484 条记录，仅 2025 年就新增了 245 条，增长约 20%。本技能涵盖将 KEV 目录与 EPSS（漏洞利用预测评分系统，Exploit Prediction Scoring System）和 CVSS 整合到漏洞优先级工作流中，创建基于风险的方法，将已确认利用活动的漏洞优先级置于单纯理论严重性之上。
CISA 已知被利用漏洞（KEV，Known Exploited Vulnerabilities）目录由约束性操作指令（BOD，Binding Operational Directive）22-01 建立，是一份持续更新的 CVE 列表，记录了已在现实环境中被主动利用、具有重大风险的漏洞。截至 2026 年初，该目录已包含超过 1,484 条记录，仅 2025 年就新增了 245 条，增长约 20%。本技能涵盖将 KEV 目录与 EPSS（漏洞利用预测评分系统，Exploit Prediction Scoring System）和 CVSS 整合到漏洞优先级工作流中，创建基于风险的方法，将已确认利用活动的漏洞优先级置于单纯理论严重性之上。
每个 KEV 条目包含：
| CVE 发布日期 | 修复截止时间 |
|---|---|
| 2021 年或之后 | 列入 KEV 后 2 周 |
| 2021 年之前 | 列入 KEV 后 6 个月 |
| 因素 | 权重 | 数据来源 | 理由 |
|---|---|---|---|
| CISA KEV 收录 | 30% | CISA KEV JSON 数据源 | 已确认主动利用 |
| EPSS 评分 | 25% | FIRST EPSS API | 预测漏洞利用概率 |
| CVSS 基础分 | 20% | NVD API v2.0 | 漏洞固有严重性 |
| 资产关键性 | 15% | CMDB/资产清单 | 业务影响背景 |
| 网络暴露程度 | 10% | 网络架构 | 攻击面可访问性 |
| KEV 收录 | EPSS > 0.5 | CVSS >= 9.0 | 优先级 | SLA |
|---|---|---|---|---|
| 是 | 任意 | 任意 | P1-紧急 | 48 小时 |
| 否 | 是 | 是 | P1-紧急 | 48 小时 |
| 否 | 是 | 否 | P2-严重 | 7 天 |
| 否 | 否 | 是 | P2-严重 | 7 天 |
| 否 | 否 | 否（>= 7.0） | P3-高危 | 14 天 |
| 否 | 否 | 否（>= 4.0） | P4-中危 | 30 天 |
| 否 | 否 | 否（< 4.0） | P5-低危 | 90 天 |
import requests
import json
from datetime import datetime
KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
def fetch_kev_catalog():
"""下载并解析 CISA KEV 目录。"""
response = requests.get(KEV_URL, timeout=30)
response.raise_for_status()
data = response.json()
catalog = {}
for vuln in data.get("vulnerabilities", []):
cve_id = vuln["cveID"]
catalog[cve_id] = {
"vendor": vuln.get("vendorProject", ""),
"product": vuln.get("product", ""),
"name": vuln.get("vulnerabilityName", ""),
"date_added": vuln.get("dateAdded", ""),
"description": vuln.get("shortDescription", ""),
"action": vuln.get("requiredAction", ""),
"due_date": vuln.get("dueDate", ""),
"ransomware_use": vuln.get("knownRansomwareCampaignUse", "Unknown"),
}
print(f"[+] 已从 CISA KEV 目录加载 {len(catalog)} 个 CVE")
print(f" 目录版本：{data.get('catalogVersion', 'N/A')}")
print(f" 最后更新：{data.get('dateReleased', 'N/A')}")
return catalog
kev = fetch_kev_catalog()
EPSS_API = "https://api.first.org/data/v1/epss"
def get_epss_scores(cve_list):
"""批量获取一组 CVE 的 EPSS 评分。"""
scores = {}
batch_size = 100
for i in range(0, len(cve_list), batch_size):
batch = cve_list[i:i + batch_size]
cve_param = ",".join(batch)
response = requests.get(EPSS_API, params={"cve": cve_param}, timeout=30)
if response.status_code == 200:
for entry in response.json().get("data", []):
scores[entry["cve"]] = {
"epss": float(entry.get("epss", 0)),
"percentile": float(entry.get("percentile", 0)),
}
return scores
import pandas as pd
def prioritize_vulnerabilities(scan_results, kev_catalog, epss_scores):
"""对扫描结果应用多因素优先级排序。"""
prioritized = []
for vuln in scan_results:
cve_id = vuln.get("cve_id", "")
cvss_score = float(vuln.get("cvss_score", 0))
asset_criticality = float(vuln.get("asset_criticality", 3))
exposure = float(vuln.get("network_exposure", 3))
in_kev = cve_id in kev_catalog
kev_data = kev_catalog.get(cve_id, {})
epss_data = epss_scores.get(cve_id, {"epss": 0, "percentile": 0})
epss_score = epss_data["epss"]
# 综合风险分计算
risk_score = (
(1.0 if in_kev else 0.0) * 10 * 0.30 +
epss_score * 10 * 0.25 +
cvss_score * 0.20 +
(asset_criticality / 5.0) * 10 * 0.15 +
(exposure / 5.0) * 10 * 0.10
)
# 分配优先级
if in_kev or (epss_score > 0.5 and cvss_score >= 9.0):
priority = "P1-紧急"
sla_days = 2
elif epss_score > 0.5 or cvss_score >= 9.0:
priority = "P2-严重"
sla_days = 7
elif cvss_score >= 7.0:
priority = "P3-高危"
sla_days = 14
elif cvss_score >= 4.0:
priority = "P4-中危"
sla_days = 30
else:
priority = "P5-低危"
sla_days = 90
prioritized.append({
"cve_id": cve_id,
"cvss_score": cvss_score,
"epss_score": round(epss_score, 4),
"epss_percentile": round(epss_data["percentile"], 4),
"in_cisa_kev": in_kev,
"ransomware_use": kev_data.get("ransomware_use", "N/A"),
"kev_due_date": kev_data.get("due_date", "N/A"),
"risk_score": round(risk_score, 2),
"priority": priority,
"sla_days": sla_days,
"asset": vuln.get("asset", ""),
"asset_criticality": asset_criticality,
})
df = pd.DataFrame(prioritized)
df = df.sort_values("risk_score", ascending=False)
return df
def generate_report(df, output_file="kev_prioritized_report.csv"):
"""从优先级排序的漏洞数据生成摘要报告。"""
print("\n" + "=" * 70)
print("漏洞优先级排序报告 — KEV + EPSS + CVSS")
print("=" * 70)
print(f"\n已分析漏洞总数：{len(df)}")
print(f"KEV 收录的漏洞：{df['in_cisa_kev'].sum()}")
print(f"与勒索软件关联：{(df['ransomware_use'] == 'Known').sum()}")
print("\n优先级分布：")
print(df["priority"].value_counts().to_string())
print("\n前 15 个高风险漏洞：")
top = df.head(15)[["cve_id", "cvss_score", "epss_score", "in_cisa_kev",
"risk_score", "priority"]]
print(top.to_string(index=False))
df.to_csv(output_file, index=False)
print(f"\n[+] 完整报告已保存到：{output_file}")
npx claudepluginhub killvxk/cybersecurity-skills-zhIntegrates CISA KEV, EPSS, and CVSS data to prioritize CVE remediation based on real-world exploitation evidence. Useful for vulnerability management and security assessments.
Prioritizes CVE remediation using CISA KEV catalog, EPSS, and CVSS scores based on real-world exploitation evidence. For security assessments and vulnerability management workflows.
Prioritizes CVE remediation using CISA KEV catalog for exploited vulns, EPSS prediction scores, CVSS severity, asset criticality, and exposure.