CLI commands

The vulnmgmt CLI (aliased vm) is a Click application. cli.py defines the top-level main group and a handful of commands directly, then attaches the command groups defined in the cli_*.py modules and the integration packages.

Every command supports --help. Run vulnmgmt <command> --help for the authoritative option list. For what happens under the hood, see the Processing pipeline.

Command groups at a glance

Command	Source	Purpose
process, research, analyze, versions, vendors, export, info	cli.py	Legacy inventory processing, CVE research, reporting
integrations	cli.py	Rapid7 / Defender / SentinelOne setup, search, sync, reports
vuln	cli_vuln.py	Modern scan/enrich/score pipeline
cpe	cli_vuln.py	CPE dictionary search & application mapping
intune	cli_intune.py	Intune CSV → dedupe → NVD scan pipeline
enrich	cli_enrich.py	CVE enrichment (NVD / EPSS / CISA KEV)
db	cli_db.py	PostgreSQL schema & migrations
sync	cli_sync.py	Rapid7 → database sync
worker	cli_worker.py	Background scheduler control
cw / connectwise	integrations/connectwise	ConnectWise Manage ticketing
epss	integrations/epss	FIRST.org EPSS scores

---

Top-level commands (cli.py)

process

Process an application-inventory CSV and generate a vulnerability tracking Excel workbook (legacy pandas path).

Option	Purpose
INPUT_FILE (arg)	Path to inventory CSV
-o, --output	Output .xlsx (default vulnerability_report.xlsx)
--max-rows	Max rows to process (default 5000)
--no-vendor-summary, --no-high-priority	Skip those sheets
-q, --quiet	Quiet mode

vulnmgmt process AppInventory.csv -o vuln_report.xlsx

research

Research vulnerabilities across NVD, CVE.org, and CISA KEV.

Option	Purpose
--cve	CVE ID (e.g. CVE-2024-1234)
--product, --vendor	Product / vendor search
-o, --output	Save results to JSON

vulnmgmt research --cve CVE-2024-1234
vulnmgmt research --product "Chrome" --vendor Google -o results.json

analyze

Risk-score and analyze an inventory CSV (legacy RiskAnalyzer / DeepAnalyzer).

Option	Purpose
INPUT_FILE (arg)	Inventory CSV
--risk-scoring	Run risk scoring
--deep-analysis	Run deep analysis
--top	Show top N risky apps (default 20)
-o, --output	Save analysis JSON

vulnmgmt analyze data.csv --risk-scoring --top 10

versions

Track software versions across the inventory and produce a version-spread Excel report.

vulnmgmt versions data.csv -o version_report.xlsx
vulnmgmt versions data.csv --app "Google Chrome"

vendors

View the built-in vendor security-bulletin database (VENDOR_SECURITY_URLS).

vulnmgmt vendors --list
vulnmgmt vendors --search Microsoft
vulnmgmt vendors --stats

export

Export processed applications to JSON or CSV with optional filters.

Option	Purpose
--format	json or csv
-o, --output	Output path (required)
--filter-vendor, --min-devices	Filters

vulnmgmt export data.csv --format csv -o filtered.csv --min-devices 50

info

Print configuration (output/data dirs, rate limits, cache) and the feature list.

vulnmgmt info

integrations

A group for enterprise security platforms. PLATFORM is one of rapid7, defender, sentinelone (support varies per subcommand). Credentials are stored encrypted via the key manager.

Subcommand	Purpose
setup PLATFORM	Interactive credential setup (encrypted, with rotation policy)
info PLATFORM	Show integration info & quick stats
test PLATFORM	Test the connection
search PLATFORM	Advanced asset/vuln filtering (Rapid7) — --asset-filter, --vuln-filter, --limit
explore PLATFORM RESOURCE	Browse vulnerabilities / assets / devices — --severity, --search, --search-type, --cvss-min, --export, --raw
test-asset PLATFORM	Vulnerability lookup for one asset (Rapid7) — --asset
report PLATFORM	Generate a full Excel report — -o, --include-vulns, --include-cves
sync PLATFORM	Sync vulnerabilities/assets/alerts/… to xlsx/json/csv — --type, --limit, --filter
keys list|delete|rotate	Manage stored credentials

vulnmgmt integrations setup rapid7
vulnmgmt integrations explore rapid7 vulnerabilities --severity Critical --export critical.csv
vulnmgmt integrations report sentinelone -o s1_report.xlsx --include-cves

---

vuln — modern scan pipeline (cli_vuln.py)

The end-to-end scan/enrich/score workflow. Enrichment reads threat-intel API keys from a .env.local file (VirusTotal, OTX, GreyNoise, Shodan, AbuseIPDB, URLhaus).

Subcommand	Purpose	Key options
convert CSV	Convert Intune/Defender CSV → scan-ready JSON (extract unique apps)	--filter-app, --filter-vendor, --min-devices, --max-devices, --platform, --limit, --explain
lookup	Look up + optionally enrich/score a single app	--app, --version, --vendor, --assets, --criticality, --enrich, --sources, -o
scan APPS_FILE	Scan many apps from a JSON/CSV file	--enrich, --sources, -o
pipeline INPUT_FILE	Run all 5 steps (load → map → enrich → score → report)	-o, --excel
export JSON_FILE	Export scan JSON to a 6-sheet Excel or a DOCX report	-f xlsx|docx, -o
docs	Print integration documentation / API links	—
cpe	The CPE subgroup (see below)	—

# Full workflow
vulnmgmt vuln convert data/AppInvRawData.csv --min-devices 50 -o apps.json
vulnmgmt vuln scan apps.json --enrich -o results.json
vulnmgmt vuln export results.json -o report.xlsx

# Single app, enriched and scored
vulnmgmt vuln lookup --app "Apache Log4j" --version "2.14.1" --vendor Apache --enrich

# One-shot pipeline
vulnmgmt vuln pipeline apps.json -o results.json

cpe — CPE management (cli_vuln.py)

Search and map CPE entries. Available both as vulnmgmt cpe … and vulnmgmt vuln cpe ….

Subcommand	Purpose
search KEYWORD	Search the NVD CPE dictionary (-n max results, -o JSON)
match	Match an app to CPEs with confidence scores (--app, --version, --vendor)
lookup CVE_ID	Get CPE match criteria (version ranges) for a CVE
map	Save an app→CPE mapping to cpe_mappings.json (--cpe, --confidence)
list	List saved mappings (--app filter)

vulnmgmt cpe search "Foxit Reader"
vulnmgmt vuln cpe match --app "Foxit Reader" --version "7.1.5" --vendor Foxit
vulnmgmt vuln cpe lookup CVE-2021-44228

intune — Intune inventory pipeline (cli_intune.py)

Purpose-built for raw Intune AppInventory exports: import, deduplicate by app+version, aggregate device counts, then scan against NVD with version-range matching.

Subcommand	Purpose	Key options
import CSV	Import & summarize inventory (dedupe, device counts)	--min-devices, --platform, --top, --exclude-microsoft, --filter-vendor, --filter-app, -o
scan CSV	Import then scan top apps against NVD	--top, --min-devices, --exclude-microsoft, --filter-app, --rate-limit, -o
lookup APP_NAME	Quick CVE lookup for one app	-v/--version (required), --vendor
stats CSV	Vendor/platform/version stats without hitting NVD	—

vulnmgmt intune import AppInvRawData.csv --exclude-microsoft --top 30
vulnmgmt intune scan AppInvRawData.csv --top 10 --exclude-microsoft
vulnmgmt intune lookup "Greenshot" -v "1.3.312"

Note

--exclude-microsoft filters out Microsoft Store / framework packages (Microsoft.VCLibs, Microsoft.UI.Xaml, built-in apps, etc.). intune scan also opportunistically writes results to MongoDB for the webapp frontend when a local MongoDB is reachable.

enrich — CVE enrichment (cli_enrich.py)

Test and run enrichment against NVD, FIRST.org EPSS, and CISA KEV, operating on CVEs already stored in the database.

Subcommand	Purpose
test-nvd CVE_ID	Fetch CVSS/dates from NVD
test-epss CVE_ID	Fetch EPSS score + risk interpretation
test-kev CVE_ID	Check the CISA KEV catalog
test-all CVE_ID	Run all three source tests
run	Enrich DB CVEs missing CVSS/EPSS (--limit, --force)
status	Show enrichment coverage (CVSS/EPSS/KEV/fully enriched)

vulnmgmt enrich test-all CVE-2021-44228
vulnmgmt enrich run --limit 100
vulnmgmt enrich status

db — database management (cli_db.py)

Manage the PostgreSQL schema (uses Alembic + pg_dump). See the schema summary.

Subcommand	Purpose
init	Initialize the schema (--force drops existing tables)
migrate -m MSG	Create an Alembic autogenerate migration
upgrade	Apply pending migrations (alembic upgrade head)
status	Connectivity, table count, record counts, current migration
backup	pg_dump to a timestamped .sql file (-o)

vulnmgmt db init
vulnmgmt db migrate -m "add findings index"
vulnmgmt db upgrade
vulnmgmt db status

sync — Rapid7 → database (cli_sync.py)

Run the Rapid7 sync tasks and inspect what has been synced. (Distinct from integrations sync, which exports to files.)

Subcommand	Purpose
run rapid7	Full (--full, default) or --incremental sync into Postgres
status	Active asset count, updates in last 24h, last sync time
history	Recently synced assets (--hours)

vulnmgmt sync run rapid7 --full
vulnmgmt sync status

worker — background scheduler (cli_worker.py)

Control the APScheduler worker that runs the periodic sync/enrichment/SLA jobs (see worker jobs).

Subcommand	Purpose
start	Start the blocking APScheduler worker
status	Check the vulnmgmt-worker Docker container
logs	Tail worker logs
schedule	Print the scheduled-job table

vulnmgmt worker start
vulnmgmt worker schedule

cw / connectwise — ConnectWise Manage (integrations/connectwise)

Manage PSA tickets from vulnerability findings.

Subcommand	Purpose
test	Test the ConnectWise connection
boards, statuses, priorities, companies	List reference data
tickets list	List tickets on a board (-b, -c, --include-closed, -n)
tickets create	Create a vuln ticket (--cve, --app, --severity, --cvss, -c, -b)
tickets view ID / tickets update ID	View / update / close a ticket
sync create-tickets	Bulk-create tickets from a findings file (-f, -c, -b, --threshold, --dry-run)
sync close CVE_IDS…	Close tickets for remediated CVEs

vulnmgmt cw tickets create --cve CVE-2024-1234 --app "Foxit Reader" \
  --severity HIGH -c 123 -b 45
vulnmgmt cw sync create-tickets -f findings.json -c 123 -b 45 --threshold HIGH --dry-run

epss — EPSS scores (integrations/epss)

Query FIRST.org EPSS exploit-probability scores directly.

Subcommand	Purpose
score CVE_ID	Single CVE EPSS score
batch CVE_IDS…	Batch lookup (--delay)
high-risk	List high-EPSS CVEs (--threshold, --limit)
stats / clear	Cache stats / clear cache

vulnmgmt epss score CVE-2021-44228
vulnmgmt epss high-risk --threshold 0.5 --limit 25