How cisagov/csaf works
This repository publishes CISA IT and OT security advisories as CSAF 2.0 documents, alongside distribution metadata and integrity sidecars. The main user workflow is to discover and consume those machine-readable advisories; users of the included CSAF2MD tool can instead place JSON files in its input directory and generate human-readable Markdown. A separate checker evaluates advisories against CISA requirements and CWE status. The README establishes the repository’s distribution and republication purpose; tool wiring is based on the sampled source excerpts, so uncertain calls are omitted.
Main entry points: csaf2md.py CSAF2MD entry · cisareqcheck.py Requirements checker · input JSON input files · exec_summary.py Advisory summaries
Components 18
Advisory distribution
- IT advisories
csaf_files/IT/white - OT advisories
csaf_files/OT/white - Vulnerability advisories
csaf_files/VA/white - IT feed metadata
csaf_files/IT/white
Markdown conversion
- CSAF2MD entry
tools/csaf2md/csaf2md.py - JSON input files
tools/csaf2md/input - Advisory summaries
tools/csaf2md/lib/exec_summary.py - Product mapping
tools/csaf2md/lib/product_helper.py - CVSS formatting
tools/csaf2md/lib/score_helper.py - Mitigation details
tools/csaf2md/lib/rem_helper.py - Markdown documents
tools/csaf2md/output
Advisory checking
- Requirements checker
tools/csaf2md/cisareqcheck.py - CSAF requirement rules
tools/csaf2md/lib/requirements.py - CWE status checks
tools/csaf2md/lib/cwe_helper.py - CWE status data
tools/csaf2md/lib
Other components
- Vendor or consumer
- Tool user
- Advisory maintainer
Connections 17
- Vendor or consumer → IT advisories: consumes
- Vendor or consumer → OT advisories: consumes
- Vendor or consumer → Vulnerability advisories: consumes
- Vendor or consumer → IT feed metadata: discovers
- Tool user → JSON input files: supplies JSON
- JSON input files → CSAF2MD entry: reads files
- CSAF2MD entry → Advisory summaries: builds sections
- Advisory summaries → Product mapping: resolves products
- CSAF2MD entry → CVSS formatting: formats scores
- CSAF2MD entry → Mitigation details: builds mitigations
- CSAF2MD entry → Markdown documents: writes documents
- Advisory maintainer → Requirements checker: runs checks
- Requirements checker → JSON input files: reads JSON
- Requirements checker → CSAF requirement rules: checks requirements
- CSAF requirement rules → Product mapping: checks product tree
- Requirements checker → CWE status checks: checks CWE status
- CWE status checks → CWE status data: reads status