v2.2.0 — Vulnerability Triage, Log Parsing & SIEM Export

[AbdaullahAG]

What's New

ThreatLens goes beyond IOC lookups into lightweight CVE triage, structured log ingestion, and SIEM export.

CVE Decision Cards

Checks every CVE against CISA KEV and FIRST.org EPSS alongside NVD's CVSS score, then produces a deterministic Patch / Isolate / Monitor / Not affected recommendation — with the reasoning behind it, not a black-box score. A KEV listing is a hard floor: it's never downgraded to "Monitor."

python main.py -c CVE-2021-44228 --apis nvd cisa_kev epss --decision-cards

Asset Inventory

Import a CSV of your hosts (--import-assets assets.csv) and the decision logic factors in whether an affected product is actually running anywhere, and whether that asset is internet-facing and business-critical.

New Log Formats

--file now auto-detects (or accepts --log-format) for:

• Zeek TSV logs (conn/dns/http/ssl/files.log)
• Suricata eve.json
• Sysmon (JSON-exported Windows Event Log)
• Generic JSONL

All streamed line-by-line — a single malformed line never aborts the scan.

SIEM Export (opt-in)

python main.py --file eve.json --log-format suricata --export splunk

Send results to Splunk (HEC), Elastic (_bulk), or Microsoft Sentinel — using the modern Logs Ingestion API, not the deprecated HTTP Data Collector API. Host allow-listed, TLS verified by default, retried with backoff, and one destination failing never blocks the others.

Evidence Packs

python main.py -i 45.33.32.156 --evidence-pack

Bundles an investigation's results (and decision cards/assets, if produced) into a ZIP with a manifest.json recording a SHA-256 hash of every file inside, for basic chain-of-custody.

---

Security

• All new inputs (CSV rows, log lines, CISA KEV feed entries) are validated with an allow-list approach; malformed rows are skipped, never fatal
• No new third-party dependencies — CSV import, log parsing, and evidence packing all use the Python standard library
• SIEM credentials are read only from config/keys.env, never logged, never written into evidence packs
• ruff and bandit both pass clean on the new code

Testing

155 passed, 1 skipped — up from 60. 95 new tests across enrichers, decision logic, asset import, log parsers, exporters, and evidence packs.

Upgrade Notes

No breaking changes. New settings in config/keys.env are all optional (CISA KEV/EPSS need no key; SIEM export is opt-in and inactive unless fully configured).

Full changelog: CHANGELOG.md

---

This discussion was created from the release v2.2.0 — Vulnerability Triage, Log Parsing & SIEM Export.