Vulnerability csv reporting

Vulnerability CSV Reporting

Creating a clear and structured CSV report is essential for communicating security audit findings.

CSV Schema

For a standard security audit, the following columns are often used: Package,Version,CVE_ID,Severity,CVSS_Score,Fixed_Version,Title,Url

Python Example for CSV Generation

Using the csv module in Python ensures proper escaping of fields that might contain commas or quotes (like titles and descriptions).

import csv
import json

def generate_report(vulnerabilities, output_file):
    headers = ['Package', 'Version', 'CVE_ID', 'Severity', 'CVSS_Score', 'Fixed_Version', 'Title', 'Url']
    
    with open(output_file, 'w', newline='') as f:
        writer = csv.DictWriter(f, fieldnames=headers)
        writer.writeheader()
        
        for vuln in vulnerabilities:
            # Filter for High/Critical if not already done
            if vuln['Severity'] not in ['HIGH', 'CRITICAL']:
                continue
                
            writer.writerow({
                'Package': vuln.get('PkgName'),
                'Version': vuln.get('InstalledVersion'),
                'CVE_ID': vuln.get('VulnerabilityID'),
                'Severity': vuln.get('Severity'),
                'CVSS_Score': extract_cvss(vuln.get('CVSS')), # Using logic from CVSS skill
                'Fixed_Version': vuln.get('FixedVersion') or 'N/A',
                'Title': vuln.get('Title') or vuln.get('Description', '')[:100],
                'Url': vuln.get('PrimaryURL')
            })

Best Practices

• Escaping: Always use a CSV library instead of manual string concatenation to handle special characters.
• Filtering: Apply severity filters early to reduce noise in the report.
• Completeness: Ensure 'N/A' is used for missing optional fields like FixedVersion.