vulnerability-csv-reporting git:20260424.d50cf5aA

Immutable. This exact content never changes and is served at /api/v1/blob/2e08ab75044b0a19.

---
name: vulnerability-csv-reporting
description: Generate structured CSV security audit reports from vulnerability data with proper filtering and formatting.
---

# Vulnerability CSV Reporting

Creating a clear and structured CSV report is essential for communicating security audit findings.

## CSV Schema
For a standard security audit, the following columns are often used:
`Package,Version,CVE_ID,Severity,CVSS_Score,Fixed_Version,Title,Url`

## Python Example for CSV Generation

Using the `csv` module in Python ensures proper escaping of fields that might contain commas or quotes (like titles and descriptions).

```python
import csv
import json

def generate_report(vulnerabilities, output_file):
    headers = ['Package', 'Version', 'CVE_ID', 'Severity', 'CVSS_Score', 'Fixed_Version', 'Title', 'Url']
    
    with open(output_file, 'w', newline='') as f:
        writer = csv.DictWriter(f, fieldnames=headers)
        writer.writeheader()
        
        for vuln in vulnerabilities:
            # Filter for High/Critical if not already done
            if vuln['Severity'] not in ['HIGH', 'CRITICAL']:
                continue
                
            writer.writerow({
                'Package': vuln.get('PkgName'),
                'Version': vuln.get('InstalledVersion'),
                'CVE_ID': vuln.get('VulnerabilityID'),
                'Severity': vuln.get('Severity'),
                'CVSS_Score': extract_cvss(vuln.get('CVSS')), # Using logic from CVSS skill
                'Fixed_Version': vuln.get('FixedVersion') or 'N/A',
                'Title': vuln.get('Title') or vuln.get('Description', '')[:100],
                'Url': vuln.get('PrimaryURL')
            })
```

## Best Practices
- **Escaping**: Always use a CSV library instead of manual string concatenation to handle special characters.
- **Filtering**: Apply severity filters early to reduce noise in the report.
- **Completeness**: Ensure 'N/A' is used for missing optional fields like `FixedVersion`.