Merge pull request #6 from CMS-Enterprise/fix-query

fix: epss score dates invalid due to utc and limiting query by last_seen

code/reporter/lambda_function.py

@@ -2,15 +2,15 @@
 import pandas as pd
 import snowflake.connector
 import slack_report
-from datetime import date
+from datetime import date, timedelta
 from slack_sdk.webhook import WebhookClient
 
 TITLE_IGNORE = [
     'EC2.17 EC2 instances should not use multiple ENIs'
 ]
 
 def get_epss_df():
-    today = date.today()
+    today = date.today() - timedelta(days=1)
     d1 = today.strftime("%Y-%m-%d")
 
     return pd.read_csv(
@@ -61,7 +61,7 @@ def get_nessus_vulns(snowflake_cur, kev_df, epss_df):
     and intersects them with both the kev and epss dataframes
     """
     snowflake_cur.execute(
-        "select ACCOUNTID, INSTANCEID, CVE from SEC_VW_IUSG_CUMULATIVE_VULNS_BATCAVE"
+        "select ACCOUNTID, INSTANCEID, CVE from SEC_VW_IUSG_CUMULATIVE_VULNS_BATCAVE WHERE LAST_SEEN >= CURRENT_TIMESTAMP() - INTERVAL '72 hours'"
     )
     df = snowflake_cur.fetch_pandas_all()
     df["CVE"] = df["CVE"].apply(lambda x: json.loads(x))

code/reporter/slack_report.py

@@ -5,6 +5,7 @@
     DividerBlock,
     SectionBlock,
     RichTextBlock,
+    RichTextLink,
     Message,
 )
 from slackblocks.rich_text import RichTextSection, RichTextList, ListType, RichText
@@ -82,11 +83,16 @@ def __form_blocks(self):
             kev_vuln_block.elements.append(
                 RichTextList(
                     style=ListType.BULLET,
+                    indent=1,
                     elements=[
                         RichTextSection(
                             elements=[
+                                RichTextLink(
+                                    text=f"{x.cve}",
+                                    url=f"https://www.cvedetails.com/cve/{x.cve}"
+                                ),
                                 RichText(
-                                    text=f"{x.cve} present across {str(x.num_env)} AWS Accounts"
+                                    text=f" present across {str(x.num_env)} AWS Accounts"
                                 )
                             ]
                         )
@@ -119,11 +125,16 @@ def __form_blocks(self):
             epss_vuln_block.elements.append(
                 RichTextList(
                     style=ListType.BULLET,
+                    indent=1,
                     elements=[
                         RichTextSection(
                             elements=[
+                                RichTextLink(
+                                    text=f"{x.cve}",
+                                    url=f"https://www.cvedetails.com/cve/{x.cve}"
+                                ),
                                 RichText(
-                                    text=f"{x.cve} present across {str(x.num_env)} AWS Accounts"
+                                    text=f" present across {str(x.num_env)} AWS Accounts"
                                 )
                             ]
                         )