:EA DATA. SF: @Sidneys1 Using that page I've been able to build a fancy test query. I am using the NVD API since it doesn't require authentication and the data that comes back is complicated enough to give me lots to try.
I've built this up over the last few days. I am querying NVD for all CVEs that are in the CISA KEVC then pulling out just the ones that apply to Windows Server 2008, 2012, 2016, and 2019. I could have just done different NVD searches but this was an exercise for how to parse JSON with jq
A week ago, jq '.' was about all I knew how to do.
Now I have created this.
curl https://services.nvd.nist.gov/rest/json/cves/2.0?hasKev | jq '. | .vulnerabilities | map(
if isempty(
.cve.configurations | map(
.nodes | map(
.cpeMatch | map(
if (
.criteria | test(
"windows_server_20(08)|(1[269])"
)
)
then .
else empty
end
)
)
)
)
then empty
else .
end
)'
Which seems to do what I want it to do.
I was deleting some fields at one point just to see if I knew how to do it, but I took that part out.
I found type and keys to be indispensable for figuring out what each new layer was offering me to work with.
That manual page https://jqlang.org/manual is fantastic. I also found out that it is designed to work just as well on a computer screen as a mobile device screen. I was able to keep reading through it with no loss in usability when I only had my phone handy.
If any jq devs or anybody responsible for that website is on the Fediverse, let them know how much I appreciate the work that was put into creating the tool and documenting how to use it.
su || cd 
Check this out.
**spdx**: Helper crate for SPDX expressions.
Docs: 
GitHub: 
