jp-security-advisories

Files (37)

• NOTICES.md
• SKILL.md
• SKILL_ja.md
• pytest.ini
• detail-response-schema.json · references/
• error-response-schema.json · references/
• list-response-schema.json · references/
• sources.md · references/
• fetch_advisories.py · scripts/
• __init__.py · scripts/jpsec/
• __init__.py · scripts/jpsec/adapters/
• _base.py · scripts/jpsec/adapters/
• jpcert.py · scripts/jpsec/adapters/
• myjvn_alert.py · scripts/jpsec/adapters/
• myjvn_vuln.py · scripts/jpsec/adapters/
• cli.py · scripts/jpsec/
• filters.py · scripts/jpsec/
• http_cache.py · scripts/jpsec/
• ids.py · scripts/jpsec/
• output.py · scripts/jpsec/
• pyproject.toml · scripts/
• uv.lock · scripts/
• conftest.py · tests/
• jpcert-at.html · tests/fixtures/details/
• jpcert-all.rdf · tests/fixtures/feeds/
• jpcert.rdf · tests/fixtures/feeds/
• getAlertList.atom.xml · tests/fixtures/myjvn/
• getAlertList.json · tests/fixtures/myjvn/
• getVulnDetailInfo-rich.xml · tests/fixtures/myjvn/
• getVulnDetailInfo.xml · tests/fixtures/myjvn/
• getVulnOverviewList.rdf · tests/fixtures/myjvn/
• test_cli.py · tests/
• test_http_cache.py · tests/
• test_jpcert_adapter.py · tests/
• test_myjvn_alert.py · tests/
• test_myjvn_vuln.py · tests/
• test_output.py · tests/

SKILL.md (first lines)

# Japan Security Advisories

Aggregate and search Japanese security advisories — JPCERT/CC alerts and
the MyJVN API endpoints — and retrieve the body of individual advisories.

## When to use this skill

Use this skill when the user wants to:

- List or search **JPCERT/CC** 注意喚起 (alerts), Weekly Reports, TSUBAME
  reports, or JPCERT/CC Eyes blog posts
- List or search **IPA 注意警戒情報** (IPA security alerts) via the MyJVN
  API (`getAlertList`)
- List or search **JVN iPedia** vulnerability database via the MyJVN API
  (`getVulnOverviewList`) — supports CPE, keyword, CVSS severity, and
  multi-axis date filtering
- Get the structured detail of a JVN iPedia entry (`getVulnDetailInfo`) —
  affected products, CVSS scores, related CVEs, mitigation
- Get the body of a JPCERT/CC alert (HTML parsing — JPCERT does not expose
  a structured API)

This skill is complementary to `aws-security-bulletins`, which covers AWS
disclosures only.

## Sources

| `--sources` value | Backend | Coverage |
|---|---|---|
| `jpcert` | RSS (`https://www.jpcert.or.jp/rss/jpcert.rdf`) + HTML | JPCERT/CC alerts, urgent reports, latest Weekly Report vulnerabilities |
| `jpcert-all` | RSS (`https://www.jpcert.or.jp/rss/jpcert-all.rdf`) + HTML | `jpcert` + announcements + new JVN posts |
| `myjvn-alert` | **MyJVN API** `getAlertList` (Atom XML / JSON) | IPA 注意警戒情報, with structured related-references |
| `myjvn-vuln` | **MyJVN API** `getVulnOverviewList` + `getVulnDetailInfo` | JVN iPedia vulnerability database |

`jpcert` requires HTML scraping for advisory detail because JPCERT/CC does
not provide a structured API. `myjvn-alert` and `myjvn-vuln` rely entirely
on the MyJVN API and return XSD-validated XML.

Default `--sources`: `jpcert myjvn-alert myjvn-vuln`.

See [references/sources.md](references/sources.md) for endpoint details,
parameter mappings, and known limits.

## Workflow

First decide whether the user wants **(1) list/search** or **(2) detail**.
Then run the appropriate sub-command.

### 1. List / Search advisories

#### 1-a. Determine arguments

| Argument | Description | Default |
|---|---|---|
| `--sources` | One or more of `jpcert`, `jpcert-all`, `myjvn-alert`, `myjvn-vuln`, `all` | `jpcert myjvn-alert myjvn-vuln` |
| `--start-date` | ISO date `YYYY-MM-DD` (inclusive) | 90 days ago |
| `--end-date` | ISO date `YYYY-MM-DD` (inclusive) | today |
| `--no-date-filter` | Disable the date filter entirely | off |
| `--date-mode` | For `myjvn-vuln`: `public` / `published` / `first-published` (which date axis to filter) | `published` |
| `--keywords` | Space-separated keywords (OR, case-insensitive). Server-side for `myjvn-vuln`, client-side for others | (none) |
| `--category` | Filter by category — see [references/sources.md](references/sources.md) | (none) |
| `--cve` | One or more CVE identifiers. OR-matched against extracted CVEs | (none) |
| `--severity` | For `myjvn-vuln`: `none`, `low`, `medium`, `high`, `critical` | (none) |
| `--cpe` | For `myjvn-vuln`: CPE identifier (e.g. `cpe:/a:apache:tomcat`) | (none) |
| `--limit` | Cap the number of items returned | unlimited |
| `--format` | `json`, `csv`, or `markdown` | `json` |
| `--cache-dir` | If supplied, cache HTTP responses under this directory using ETag / Last-Modified conditional GETs. **Omitted by default — no files are written when the flag is absent.** | (off) |

If the user's intent is ambiguous (no source, no date, no keyword), ask
whether to proceed with the defaults.

#### 1-b. Sub-commands

```bash
uv run --project scripts scripts/fetch_advisories.py list-sources
uv run --project scripts scripts/fetch_advisories.py list [...]
uv run --project scripts scripts/fetch_advisories.py detail [...]
```

`list-sources` prints available sources, their backend endpoints, and
the categories supported per source.

#### 1-c. Run

```bash
uv run --project scripts scripts/fetch_advisories.py list \
  [--sources <s1> <s2> ...] \
  [--start-date YYYY-MM-DD] [--end-date YYYY-MM-DD] [--no-date-filter] \
  [--date-mode public|published|first-published] \
  [--keywords <kw1> <kw2> ...] \
  [--category <cat>] \
  [--cve <CVE-YYYY-NNNN> ...] \
  [--severity none|low|medium|high|critical] \
  [--cpe <cpe-string>] \
  [--limit N] \
  [--format json|csv|markdown]
```

Output JSON conforms to
[references/list-response-schema.json](references/list-response-schema.json).

#### 1-d. Format the output

For JSON output, render a Markdown table for the user:

| # | Source | Category | Date | Title | CVEs | Severity | URL |

`--format markdown` emits the Markdown table directly.

#### 1-e. Follow up

Ask the user whether they want detail for a specific advisory.

### 2. Get advisory detail

#### 2-a. Confirm input

A URL, or where applicable an ID:

- JPCERT URL (`https://www.jpcert.or.jp/at/.../...`)

From aws-samples/sample-fsi-reference-architecture-jp, MIT-0.

More from aws-samples/sample-fsi-reference-architecture-jp