From MSRC API to ZDI chart

ZDI, a.k.a ZeroDayInitiative, has a nice chart about updates published by the MSRC

I wondered how I could get the same in a grid view with PowerShell…

	#Requires -Module MsrcSecurityUpdates
	(Get-MSRCCvrfDocument –ID "$((Get-Date).ToString('yyyy-MMM',[System.Globalization.CultureInfo]'en-US'))").Vulnerability |
	Foreach-Object {
	$v = $_
	$Disclosed = $Exploited = $null
	$Disclosed = ([regex]'Publicly\sDisclosed:(?<D>(Yes|No));').Match("$(($v.Threats | Where-Object { $_.Type -eq 1}).Description.Value)") |
	Select-Object –ExpandProperty Groups| Select-Object –Last 1 –ExpandProperty Value
	$Exploited = ([regex]'Exploited:(?<E>(Yes|No));').Match("$(($v.Threats | Where-Object { $_.Type -eq 1}).Description.Value)") |
	Select-Object –ExpandProperty Groups| Select-Object –Last 1 –ExpandProperty Value
	[PSCustomObject]@{
	CVEID = $v.CVE
	Tag = $($v.Notes | Where-Object { $_.Type -eq 7}).Value
	CNA = $($v.Notes | Where-Object {$_.Type -eq 8}).Value
	Title = $v.Title.Value
	Date = $($v.RevisionHistory | Select-Object –First 1 –ExpandProperty Date)
	Revision = $($v.RevisionHistory | Select-Object –First 1 –ExpandProperty Number)
	Severity = $( ($v.Threats | Where-Object { $_.Type -eq 3 }).Description | Select-Object –ExpandProperty Value –ErrorAction SilentlyContinue | Sort-Object –Unique)
	CVSS = '{0:N1}' -f $($v.CVSSScoreSets.BaseScore | Sort-Object –Unique | ForEach-Object { [double]$_} | Sort-Object –Descending | Select-Object –First 1)
	Public = $Disclosed
	Exploited = $Exploited
	Type = $( ($v.Threats | Where-Object { $_.Type -eq 0 }).Description | Select-Object –ExpandProperty Value –ErrorAction SilentlyContinue | Sort-Object –Unique)
	}
	} |
	Select-Object –Property CVEID,Title,Severity,CVSS,Public,Exploited,Type |
	Out-GridView

view raw Get-MSRCtoZDI.ps1 hosted with ❤ by GitHub

Here’s what the result looks like for February 2022:

Advertisement