com.metaeffekt.artifact.enrichment.other.EpssEnrichment Maven / Gradle / Ivy

Go to download
Show more of this group Show more artifacts with this name
Show all versions of ae-artifact-analysis Show documentation
The newest version!
package com.metaeffekt.artifact.enrichment.other;

import com.metaeffekt.artifact.enrichment.InventoryEnricher;
import com.metaeffekt.artifact.enrichment.configurations.EpssConfiguration;
import com.metaeffekt.mirror.contents.base.VulnerabilityContextInventory;
import com.metaeffekt.mirror.contents.epss.EpssData;
import com.metaeffekt.mirror.contents.vulnerability.Vulnerability;
import com.metaeffekt.mirror.download.documentation.EnricherMetadata;
import com.metaeffekt.mirror.download.documentation.InventoryEnrichmentPhase;
import com.metaeffekt.mirror.query.EpssIndexQuery;
import lombok.Setter;
import lombok.extern.slf4j.Slf4j;
import org.metaeffekt.core.inventory.processor.configuration.ProcessConfiguration;
import org.metaeffekt.core.inventory.processor.model.Inventory;

import java.io.File;
import java.util.Optional;
import java.util.concurrent.atomic.AtomicInteger;

@Slf4j
@EnricherMetadata(
        name = "EPSS Enrichment", phase = InventoryEnrichmentPhase.VULNERABILITY_PRIORITIZATION,
        intermediateFileSuffix = "epss", mavenPropertyName = "epssEnrichment"
)
public class EpssEnrichment extends InventoryEnricher {

    private final EpssIndexQuery epssIndexQuery;

    @Setter
    private EpssConfiguration configuration = new EpssConfiguration();

    public EpssEnrichment(File baseMirrorDirectory) {
        this.epssIndexQuery = new EpssIndexQuery(baseMirrorDirectory);
    }

    @Override
    protected void performEnrichment(Inventory inventory) {
        final VulnerabilityContextInventory vInventory = VulnerabilityContextInventory.fromInventory(inventory);

        log.info("Enriching inventory with EPSS data for [{}] vulnerabilities.", vInventory.getVulnerabilities().size());
        final AtomicInteger amountEpss = new AtomicInteger(0);
        for (final Vulnerability vulnerability : vInventory.getVulnerabilities()) {
            Optional epssData = epssIndexQuery.getEpssData(vulnerability);
            if (!epssData.isPresent()) {
                log.info("No EPSS data found for vulnerability: {}", vulnerability.getId());
                continue;
            }
            vulnerability.setEpssData(epssData.get());
            amountEpss.incrementAndGet();
        }
        log.info("[{}] vulnerabilities enriched with EPSS data.", amountEpss.get());

        vInventory.writeBack();
    }

    @Override
    public ProcessConfiguration getConfiguration() {
        return configuration;
    }
}