cve-search
Vulnerability forecast
https://github.com/FIRSTdotorg/Vuln4Cast
Low priority idea to add it in vulnerability-lookuo
@cedricbonhomme Thanks for the EPSS integration in vulnerability-lookup.
I'll keep the issue open if we want to develop a new model if we see limit in the EPSS model.
Seeing this PR on cve-search https://github.com/cve-search/cve-search/pull/1153
There is a current EPSS score dump available at the following location:
https://epss.empiricalsecurity.com/epss_scores-current.csv.gz
We actually use the API of FIRST.org not sure if using the dump would make sense or not (or as backup if FIRST.org API is dead).
Not sure about the license of the file. Maybe @jgamblin knows about it.
@adulau, It is the same data and under the same license. It is the preferred way to get all the data at once and is often way easier to ingest the CSV file once a day.
It is linked directly on the page here: https://www.first.org/epss/data_stats
If you switch to the direct download, wrap some basic logic around it to ensure the gz file is from the current date. They aim to get the file out by 1200 GMT, but it sometimes slips to after that time.
As an aside, the API just retrieves the CSV, parses it, and serves it.
What @jgamblin said. The CSV is the best way to download all of the scores with a single call and the API hosted by FIRST actually grabs that file to populate the data in the API. It's under the same license and the exact same data.
With the new backend we are rather reliably posting the CSV at 1:30 GMT daily. And if I were coding up a client, I would request the file by the date (the request for "epss_scores-current.csv.gz" gives you a redirect to the latest file). So if you request https://epss.empiricalsecurity.com/epss_scores-%Y-%m-%d.csv.gz of the file you are looking for you will always know what file you are requesting. Happy to talk more if you have questions.
