2b:null 2c:["$","title",null,{"children":"GreyNoise Tags | GreyNoise Intelligence | Observable"}] 31:T6f9,tagCountsByYear = { const pltByYear = function ( data, { year = "2023", ymax = null, pltWidth = width } ) { const plt = Plot.plot({ width: pltWidth, height: width / 4, style: gnStyle, subtitle: `${year} Tags (Cumulative Sum); Total ${d3.sum( data.filter((d) => d.year === year).map((d) => d.tagCt) )}`, x: { grid: true, domain: [new Date(`${year}-01-01`), new Date(`${year}-12-31`)] }, y: { grid: true, domain: [ 0, ymax ? ymax : d3.sum(data.filter((d) => d.year === year).map((d) => d.tagCt)) ] }, marks: [ Plot.areaY( data.filter((d) => d.year === year), Plot.map( { y: "cumsum" }, { x: "created_at", y: "tagCt", fill: "#3fb7ff", opacity: 3 / 4, tip: true } ) ), Plot.ruleY([0]), Plot.ruleY([ymax], { stroke: "yellow" }), Plot.frame({ strokeOpacity: 0.1 }) ] }); return plt; }; const years = [...new Set(tagAgg2.map((d) => d.year))].filter( (year) => year != "2020" ); let ymax = 0; years.forEach((year) => { ymax = d3.max([ ymax, d3.sum(tagAgg2.filter((d) => d.year === year).map((d) => d.tagCt)) ]); }); return html`

Cumulative Tag Counts By Year

Yellow line denotes highest year-end maximum tag count

${d3 .sort(years, d3.descending) .map((year) => { return pltByYear(tagAgg2, { year: year, ymax: ymax, pltWidth: width / 2.3 }); })}

`; }32:T84a,CWEcloud = { const fontFamily = "Inconsolata, monospace"; const svg = d3 .create("svg") .attr("id", "word-cloud") .attr("viewBox", [0, 0, width, height]) .attr("font-family", fontFamily) .attr("fill", "#8819B8") .attr("text-anchor", "middle"); const displaySelection = svg .append("text") .attr("font-family", "Inconsolata, monospace") .attr("text-anchor", "start") .attr("alignment-baseline", "hanging") .attr("x", 10) .attr("y", 10); const cloud = d3Cloud() .size([width, height]) .words(tagCWESummary.map((d) => Object.create(d))) .padding(1) .rotate(() => 0) .font(fontFamily) .fontSize((d) => scaleSqrt(d.value)) .on("word", ({ size, x, y, rotate, text }) => { svg .append("text") .attr("font-size", size) .attr("transform", `translate(${x},${y}) rotate(${rotate})`) .text(text) .classed("click-only-text", true) .classed("word-default", true) .on("mouseover", handleMouseOver) .on("mouseout", handleMouseOut) .on("click", handleClick); function handleMouseOver(d, i) { d3.select(this) .classed("word-hovered", true) .transition(`mouseover-${text}`) .duration(300) .ease(d3.easeLinear) .style("cursor", "pointer") .attr("font-size", size + 2) .attr("font-weight", "bold"); } function handleMouseOut(d, i) { d3.select(this) .classed("word-hovered", false) .interrupt(`mouseover-${text}`) .style("cursor", "default") .attr("font-weight", "plain") .attr("font-size", size); } function handleClick(d, i) { var e = d3.select(this); displaySelection.text( `${e.text()}: ${cweMeta .filter((d) => d.cwe_id == e.text()) .map((d) => d.cwe_name) .join("")}` ); e.classed("word-selected", !e.classed("word-selected")); } }); cloud.start(); invalidation.then(() => cloud.stop()); return svg.node(); }33:T6e2,kevCalendar = { const start = d3.utcDay.offset(d3.min(kevCounts, (d) => d.dateAdded)); const end = d3.utcDay.offset(d3.max(kevCounts, (d) => d.dateAdded)); return Plot.plot({ width: 1152, height: d3.utcYear.count(start, end) * 160, axis: null, padding: 0, x: { domain: d3.range(53) }, y: { axis: "left", domain: [-1, 1, 2, 3, 4, 5], ticks: [1, 2, 3, 4, 5], tickSize: 0, tickFormat: Plot.formatWeekday() }, fy: { padding: 0.1, reverse: true }, color: { scheme: "cividis", ticks: 6, legend: true, tickFormat: "+d", label: "# CVEs in CISA KEV Release" }, marks: [ Plot.text( d3.utcYears(d3.utcYear(start), end), calendar({ text: d3.utcFormat("%Y"), frameAnchor: "right", x: 0, y: -1, dx: -20 }) ), Plot.text( d3.utcMonths(d3.utcMonth(start), end).map(d3.utcMonday.ceil), calendar({ text: d3.utcFormat("%b"), frameAnchor: "left", y: -1 }) ), Plot.cell( kevCounts.slice(1), calendar({ date: "dateAdded", fill: d3.pairs(Plot.valueof(kevCounts, "ct"), (a, b) => (b - a) / a) }) ), new MonthLine( d3 .utcMonths(d3.utcMonth(start), end) .map((d) => d3.utcDay.offset( d, d.getUTCDay() === 0 ? 1 : d.getUTCDay() === 6 ? 2 : 0 ) ), calendar({ stroke: "white", strokeWidth: 3 }) ), Plot.text( d3.utcDays(start, end), calendar({ text: d3.utcFormat("%-d"), fill: "#c3c3c3" }) ) ] }); }34:T17f6,cwes = [ "CWE-1188", "CWE-1188", "CWE-119", "CWE-119", "CWE-119", "CWE-119", "CWE-119", "CWE-119", "CWE-119", "CWE-119", "CWE-120", "CWE-120", "CWE-121", "CWE-121", "CWE-121", "CWE-121", "CWE-121", "CWE-121", "CWE-121", "CWE-121", "CWE-16", "CWE-190", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-20", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-200", "CWE-209", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-22", "CWE-255", "CWE-264", "CWE-269", "CWE-269", "CWE-269", "CWE-269", "CWE-269", "CWE-276", "CWE-284", "CWE-284", "CWE-284", "CWE-284", "CWE-284", "CWE-284", "CWE-284", "CWE-284", "CWE-285", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-287", "CWE-288", "CWE-288", "CWE-290", "CWE-290", "CWE-294", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-306", "CWE-312", "CWE-312", "CWE-326", "CWE-352", "CWE-352", "CWE-400", "CWE-415", "CWE-416", "CWE-425", "CWE-434", "CWE-434", "CWE-434", "CWE-434", "CWE-434", "CWE-434", "CWE-434", "CWE-434", "CWE-434", "CWE-436", "CWE-444", "CWE-444", "CWE-444", "CWE-444", "CWE-444", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-502", "CWE-522", "CWE-522", "CWE-522", "CWE-522", "CWE-522", "CWE-552", "CWE-552", "CWE-610", "CWE-610", "CWE-611", "CWE-611", "CWE-611", "CWE-611", "CWE-611", "CWE-665", "CWE-668", "CWE-697", "CWE-706", "CWE-707", "CWE-74", "CWE-74", "CWE-74", "CWE-74", "CWE-74", "CWE-74", "CWE-74", "CWE-74", "CWE-74", "CWE-74", "CWE-74", "CWE-74", "CWE-74", "CWE-75", "CWE-77", "CWE-77", "CWE-77", "CWE-77", "CWE-77", "CWE-77", "CWE-77", "CWE-77", "CWE-77", "CWE-770", "CWE-770", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-78", "CWE-787", "CWE-787", "CWE-787", "CWE-787", "CWE-787", "CWE-787", "CWE-787", "CWE-787", "CWE-787", "CWE-79", "CWE-79", "CWE-79", "CWE-79", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-798", "CWE-862", "CWE-863", "CWE-863", "CWE-863", "CWE-863", "CWE-863", "CWE-863", "CWE-863", "CWE-863", "CWE-863", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-89", "CWE-912", "CWE-913", "CWE-917", "CWE-917", "CWE-917", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-918", "CWE-922", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94", "CWE-94" ]35:[] 2f:{"id":"8770338ebb775ff7","slug":"greynoise-tags","title":"GreyNoise Tags","thumbnail":"70fc3e1ad40a7c384480feed45657f46302c1d609648fee583efa79a68786e25","access_level":"public","create_time":"$D2023-04-05T16:35:33.438Z","update_time":"$D2024-12-07T07:35:58.747Z","view_time":null,"first_public_time":"$D2023-04-05T19:31:07.113Z","fork":false,"stars":5,"starred":false,"owner":{"type":"team","id":"c0636623523e10bf","login":"greynoise","name":"GreyNoise Intelligence","avatar_url":"https://avatars-next.observableusercontent.com/2ae20288d0fbbcf88fa1e2621b22f2af311211721e5531c31fb610e210ea7063","tier":"starter_2024"},"version":1486,"publish_version":null,"role":null,"authored":false,"authors":[{"type":"individual","id":"4193fbe2c8b30fd3","login":"hrbrmstr","name":"boB Rudis","avatar_url":"https://avatars-next.observableusercontent.com/a26fc528815774e5c1e5ba21faf0a748a105234dd4c0fad8293732ef66c00f82","tier":null}],"members":[{"type":"individual","id":"4193fbe2c8b30fd3","login":"hrbrmstr","name":"boB Rudis","avatar_url":"https://avatars-next.observableusercontent.com/a26fc528815774e5c1e5ba21faf0a748a105234dd4c0fad8293732ef66c00f82","tier":null,"role":"editor"},{"type":"team","id":"c0636623523e10bf","login":"greynoise","name":"GreyNoise Intelligence","avatar_url":"https://avatars-next.observableusercontent.com/2ae20288d0fbbcf88fa1e2621b22f2af311211721e5531c31fb610e210ea7063","tier":"starter_2024","role":"viewer"}],"comments":[],"custom_thumbnail":false,"trashed":false,"lapsed":null,"subscribed":null,"forks":3,"collection":null,"type":"notebook","body":{"title":"GreyNoise Tags","cells":[{"id":0,"value":"# GreyNoise Tags","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":277,"value":"This notebook provides an overview of GreyNoise Tags. If there are additional stats folks would like to see just ask!\n\n- [GreyNoise Tag Volume](https://observablehq.com/@greynoise/greynoise-tags#cell-177)\n- [GreyNoise Tag Listing](https://observablehq.com/@greynoise/greynoise-tags#cell-76)\n- [CISA KEV Entries That Have a GreyNoise Tag](https://observablehq.com/@greynoise/greynoise-tags#cell-56)\n- [KEV/Tag Delta](https://observablehq.com/@greynoise/greynoise-tags#cell-354)","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":177,"value":"## GreyNoise Tag Volume","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":180,"value":"We have **${d3.format(\",\")(tagsMeta.length)}** tags.\n\n${today.getYear()+1900} Tags year-to-date: **${currentYearTags.length}** \n${today.getYear()-1+1900} Total Tags: **${prevYearTags.length}**\n\nThere are **${kevTags.length}** GreyNoise Tags with a corresponding KEV Entry \n\nWe tie or beat KEV **${d3.format(\"0.2%\")(\n kevTagDelta.filter((d) => d.delta <= 0).length / kevTagDelta.length\n)}** of the time.\n\nWe _beat_ KEV **${d3.format(\"0.2%\")(\n kevTagDelta.filter((d) => d.delta < 0).length / kevTagDelta.length\n)}** of the time.","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"meta","database":"$undefined"},{"id":111,"value":"tagTrend = Plot.plot({\n style: gnStyle,\n width: width,\n height: (1 / 1.9) * width,\n padding: 40,\n x: {\n grid: true,\n label: \"Tag Creation Date → \"\n },\n y: {\n grid: true,\n label: \"↑ GreyNoise Tag Count (Cumulative)\"\n },\n marks: [\n Plot.areaY(\n tagAgg,\n Plot.map(\n { y: \"cumsum\" },\n {\n x: \"created_at\",\n y: tagAgg.map((d) => d.tagCt),\n fill: \"#3fb7ff\",\n opacity: 3 / 4,\n tip: true\n }\n )\n )\n ]\n})","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1304,"value":"$31","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":547,"value":"## Tags Created Since Last Friday","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":541,"value":"tagsSinceLastFriday = lastWeeksTags","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"tagsSinceLastFriday","database":"$undefined"},{"id":1210,"value":"## Trending Tags","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"trendsSection","database":"$undefined"},{"id":1226,"value":"trendingTagsSparklines = table(\n d3\n .groups(trendingTags, (d) => d.name)\n .map(([name, data]) => {\n return {\n Chart: bar(\n data.map((d) => d.active_ips),\n {\n width: 240,\n height: 24,\n color: { fill: \"steelblue\" },\n highlights: { max: \"orange\" },\n margin: { vertical: 0.1, horizontal: 0.01 }\n }\n ),\n Tag: name,\n Category: data[0].category\n };\n }),\n {\n width: \"700px\",\n widths: [\"240\", \"360\"]\n }\n)","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":768,"value":"## CWE Prevalence In GreyNoise Tag Corpus","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":764,"value":"$32","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":76,"value":"## GreyNoise Tags","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":78,"value":"We have **${d3.format(\",\")(tagsMeta.length)}** tags.\n\n${today.getYear()+1900} Tags year-to-date: **${currentYearTags.length}** \n${today.getYear()+1900} Tags/day: **${currentYearTags.length / dayOfYear}** \n\nThere are **${kevTags.length}** GreyNoise Tags with a corresponding KEV Entry \n\nWe tie or beat KEV **${d3.format(\"0.2%\")(\n kevTagDelta.filter((d) => d.delta <= 0).length / kevTagDelta.length\n)}** of the time.","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"tagsPerf","database":"$undefined"},{"id":73,"value":"gnTagsMeta = tagsMeta","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"gnTagsMeta","database":"$undefined"},{"id":794,"value":"{\n const div = DOM.element(\"div\");\n const csvBtn = button(tags.tags, \"greynoise-tags-meta.csv\");\n div.appendChild(csvBtn);\n return div;\n}","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":56,"value":"## KEV Entries That Have A GreyNoise Tag","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":58,"value":"There are **${kevTags.length}** GreyNoise Tags with a corresponding KEV Entry\n\nWe tie or beat KEV **${d3.format(\"0.2%\")(\n kevTagDelta.filter((d) => d.delta <= 0).length / kevTagDelta.length\n)}** of the time.","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"kevTagMeta","database":"$undefined"},{"id":53,"value":"kevEntriesWithTags = kevTags","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"kevEntriesWithTags","database":"$undefined"},{"id":801,"value":"{\n const div = DOM.element(\"div\");\n const csvBtn = button(kevEntriesWithTags, \"kev-entries-with-tags.csv\");\n div.appendChild(csvBtn);\n return div;\n}","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1262,"value":"### KEV Tags With Ransomware","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":1472,"value":"{\n const div = DOM.element(\"div\");\n const csvBtn = button(kevTagsWRansom, \"kev-tag-ransom.csv\");\n div.appendChild(csvBtn);\n return div;\n}","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1258,"value":"kevTagsWRansom = kevTagsWithRansomware","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"kevTagsWRansom","database":"$undefined"},{"id":1249,"value":"kevTagsWithRansomware = kevEntriesWithTags.filter(\n (d) => d.knownRansomwareCampaignUse == \"Known\"\n)","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":354,"value":"## KEV/Tag Delta (lower is better)","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":1207,"value":"{\n const div = DOM.element(\"div\");\n const csvBtn = button(kevTagDelta, \"kev-tag-delta.csv\");\n div.appendChild(csvBtn);\n return div;\n}","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":356,"value":"**${d3.format(\"0.2%\")(\n kevTagDelta.filter((d) => d.delta <= 0).length / kevTagDelta.length\n)}** of the time, customers were protected _before_ CISA groked there was a big, bad CVE","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"sub1","database":"$undefined"},{"id":341,"value":"Plot.plot({\n style: gnStyle,\n height: 500,\n width: 800,\n x: {\n grid: true,\n label:\n \"Days a Tag existed before CVE was on KEV list (lower is better, green = GreyNoise beat KEV\"\n },\n y: {\n grid: true\n },\n marks: [\n Plot.dot(\n kevTagDelta,\n Plot.dodgeY({\n x: \"delta\",\n fill: (d) => (d.delta <= 0 ? \"green\" : \"white\")\n })\n )\n ]\n})","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1451,"value":"Plot.plot({\n style: gnStyle,\n height: 500,\n width: 800,\n x: {\n grid: true,\n label:\n \"Days a Tag existed before CVE was on KEV list (lower is better, green = GreyNoise beat KEV\"\n },\n y: {\n grid: true\n },\n marks: [\n Plot.dot(\n kevTagDelta,\n Plot.dodgeY({\n x: \"delta\",\n fill: (d) => (d.delta < 0 ? \"green\" : \"white\")\n })\n )\n ]\n})","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":266,"value":"SELECT * FROM \"kevTags\"","pinned":true,"hidden":false,"mode":"sql","author":"$undefined","summary":"$undefined","output":"","database":"var:kevTags"},{"id":1241,"value":"SELECT dateAdded, count(*) as ct, log(count(*)) as logct FROM \"kevEntries\" GROUP BY dateAdded","pinned":true,"hidden":false,"mode":"sql","author":"$undefined","summary":"$undefined","output":"kevCounts","database":"var:kevEntries"},{"id":1239,"value":"$33","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":805,"value":"kevSafety = Plot.plot({\n style: {\n background: \"black\",\n color: \"white\"\n },\n x: {\n ticks: 0,\n label: null\n },\n y: {\n domain: [0, 4],\n ticks: 0,\n label: null\n },\n marks: [\n Plot.text(\n [\n { x: 1, y: 3, text: \"It Has Been\" },\n { x: 1, y: 1, text: \"Days Since The\\nLast KEV Release\" }\n ],\n {\n x: \"x\",\n y: \"y\",\n text: \"text\",\n fontSize: \"30pt\",\n fontFamily: \"Handlee\"\n }\n ),\n Plot.text([\"\" + daysSinceLaseKevRelease - 1], {\n x: 1,\n y: 2,\n fontSize: \"50pt\",\n fontFamily: \"Handlee\"\n })\n ]\n})","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":912,"value":"Plot.plot({\n style: gnStyle,\n height: 300,\n x: {\n grid: true,\n label: \"Delta (days) between KEV releases. 🔵 indicates current delta\",\n ticks: 15\n },\n y: {\n grid: true\n },\n marks: [\n Plot.rectY(\n kevReleaseDelta,\n Plot.binX({ y: \"count\" }, { x: \"delta\", thresholds: 30 })\n ),\n Plot.dot([daysSinceLaseKevRelease], {\n x: daysSinceLaseKevRelease,\n y: 6,\n fill: \"steelblue\",\n r: 10\n })\n ]\n})","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1018,"value":"## KEV Tag Heatmap (30d)","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":1012,"value":"GNKevTagHeatmap = kevTagHeatmap","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":931,"value":"daysSinceLaseKevRelease = Math.ceil(\n (today - d3.max(allKevEntries.map((d) => d.dateAdded))) / (1000 * 3600 * 24)\n)","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":864,"value":"kevReleaseDelta = {\n const releaseDates = [\n ...new Set(allKevEntries.map((d) => d.dateAdded.getTime()))\n ]\n .map((time) => new Date(time))\n .sort((a, b) => a.getTime() - b.getTime());\n\n const dateDeltas = [];\n\n for (let i = 1; i < releaseDates.length; i++) {\n const diffInMillis =\n releaseDates[i].getTime() - releaseDates[i - 1].getTime();\n const diffInDays = diffInMillis / (1000 * 60 * 60 * 24); // convert milliseconds to days\n dateDeltas.push({ delta: diffInDays });\n }\n\n return dateDeltas;\n}","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":272,"value":"## All KEV Entries","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":274,"value":"$${kevEntries.length} KEV Entries To-Date","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","output":"","database":"$undefined"},{"id":270,"value":"allKevEntries = kevEntries","pinned":true,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"allKevEntries","database":"$undefined"},{"id":1041,"value":"kev2023Entries = aq\n .from(kevEntries)\n .filter((d) => aq.op.year(d.dateAdded) === 2023)\n .derive({ n: 1 })\n .orderby(\"dateAdded\")\n .derive({ csum: aq.rolling((d) => aq.op.sum(d.n)) })\n .objects()","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1192,"value":"Plot.plot({\n title: \"CISA KEV 2023\",\n x: { grid: true },\n y: { grid: true, label: \"# Entries (Cumulative)\" },\n color: {},\n width: 900,\n height: 600,\n caption: \"2023 CISA KEV Entries Count (Cumulative)\",\n marks: [\n Plot.lineY(kev2023Entries, {\n x: \"dateAdded\",\n y: \"csum\",\n tip: true\n })\n ]\n})","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":533,"value":"lastWeeksTags = tagsDB.sql`SELECT \nname, category, intention, description\nFROM tags\nWHERE created_at >= date_trunc('week', current_date) - interval '1 week' + interval '5 days'\n`","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":213,"value":"currentYearTags = tagsMeta.filter(\n (d) => d.created_at.getYear() == today.getYear()\n)","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":200,"value":"prevYearTagsToDate = tagsMeta\n .filter((d) => d.created_at <= oneYearAgo)\n .filter((d) => d.created_at.getYear() == today.getYear() - 2)","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":778,"value":"oneYearAgo = new Date(new Date().setFullYear(today.getFullYear() - 1))","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1028,"value":"dayOfYear = {\n let currentDate = new Date();\n let startOfYear = new Date(currentDate.getFullYear(), 0, 0);\n let diff = currentDate - startOfYear;\n return Math.floor(diff / (1000 * 60 * 60 * 24));\n}","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":254,"value":"prevYearTags = tagsMeta.filter(\n (d) => d.created_at.getYear() == today.getYear() - 1\n)","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":88,"value":"tagAgg = tagsDB.sql`SELECT\n created_at,\n count(*) AS tagCt\nFROM tags\nGROUP BY created_at\nORDER BY created_at ASC`","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":285,"value":"kevTagDelta = tagsDB.sql`SELECT DISTINCT (cve) created_at, cve, dateAdded, (created_at - dateAdded) as delta FROM cveTags a INNER JOIN kev b ON a.cve = b.cveID`","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":80,"value":"tagsDB = DuckDBClient.of({\n tags: tagsMeta.map((d) => {\n d.cves = \"\"; //d.cves.join(\", \");\n return d;\n }),\n kev: kevEntries,\n cveTags: kevTagCreationDate,\n shadow: shadowserver\n})","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":49,"value":"kevTags = kev.vulnerabilities.filter((d) => tagCVEs.includes(d.cveID))","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":43,"value":"tagCVECoverageCount = tagCVEs.length","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":34,"value":"tagCVEs = d3.sort([\n ...new Set(tagsMeta.filter((d) => d.cves.length > 0).flatMap((d) => d.cves))\n])","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":291,"value":"kevTagCreationDate = [\n ...new Set(\n tagsMeta\n .filter((d) => d.cves.length > 0)\n .flatMap((d) =>\n d.cves.map((cve) => ({ cve: cve, created_at: d.created_at }))\n )\n )\n]","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":14,"value":"tagsMeta = tags.tags.map((d) => {\n d.created_at = new Date(d.created_at);\n return {\n name: d.name,\n category: d.category,\n intention: d.intention,\n description: d.description,\n created_at: d.created_at,\n cves: d.cves\n };\n})","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":267,"value":"kevEntries = kev.vulnerabilities.map((d) => {\n d.dateAdded = new Date(d.dateAdded);\n d.cwes = \"\";\n return d;\n})","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":4,"value":"kev = d3.json(\"https://rud.is/data/kev.json\")","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":375,"value":"shadowserver = d3.json(\n \"https://rud.is/data/shadowserver-honeypot-cves-counts.json\"\n)","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":7,"value":"tags = d3.json(`https://rud.is/data/tags.json?d=${Date.now()}`)","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":873,"value":"ymd = (x) => {\n return (\n x.getYear() +\n 1900 +\n \"-\" +\n d3.format(\"02d\")(x.getMonth() + 1) +\n \"-\" +\n d3.format(\"02d\")(x.getDay() + 1)\n );\n}","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":363,"value":"today = new Date()","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":173,"value":"gnStyle = ({\n backgroundColor: \"black\",\n color: \"white\",\n fontFamily: \"Inconsolata\", // see font embed example at the end of the notebook\n fontSize: \"12px\",\n overflow: \"visible\",\n padding: 20,\n paddingBottom: 30\n})","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":166,"value":"css = html``","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":473,"value":"tagsElapsedDaysRunningCount = (\n await tagsDB.sql`\nWITH date_range AS (\n SELECT UNNEST(generate_series(\n (SELECT MIN(created_at) FROM tags),\n (SELECT MAX(created_at) FROM tags),\n INTERVAL '1 day'\n )) AS date\n),\ngrouped_tags AS (\n SELECT\n created_at,\n COUNT(*) AS daily_count\n FROM\n tags\n GROUP BY\n created_at\n),\njoined_dates_counts AS (\n SELECT\n dr.date,\n COALESCE(gt.daily_count, 0) AS filled_daily_count\n FROM\n date_range dr\n LEFT JOIN\n grouped_tags gt\n ON\n dr.date = gt.created_at\n)\nSELECT\n date,\n filled_daily_count,\n SUM(filled_daily_count) OVER (ORDER BY date) AS running_cumulative_sum,\n DATEDIFF('day', (SELECT MIN(date) FROM joined_dates_counts), date) AS days_elapsed\nFROM\n joined_dates_counts;\n`\n).map((d) => ({\n days_elapsed: d.days_elapsed,\n csum: d.running_cumulative_sum[0]\n}))","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":761,"value":"scaleSqrt = d3\n .scaleSqrt()\n .domain([1, d3.max(tagCWESummary.map((d) => d.value))])\n .range([20, 100])","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":756,"value":"tagCWESummary = d3\n .rollups(\n cwes,\n (group) => group.length,\n (w) => w\n )\n .sort(([, a], [, b]) => d3.descending(a, b))\n .slice(0, 250)\n .filter(([text, value]) => value > 1)\n .map(([text, value]) => ({ text, value }))","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":753,"value":"cweMeta = d3.json(\"https://rud.is/data/cwe.json\")","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":750,"value":"$34","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":747,"value":"height = 500","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":744,"value":"padding = 0","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":739,"value":"d3Cloud = require(\"d3-cloud\")","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":791,"value":"button = (data, filename = \"data.csv\") => {\n if (!data) throw new Error(\"Array of data required as first argument\");\n\n let downloadData;\n if (filename.includes(\".csv\")) {\n downloadData = new Blob([d3.csvFormat(data)], { type: \"text/csv\" });\n } else {\n downloadData = new Blob([JSON.stringify(data, null, 2)], {\n type: \"application/json\"\n });\n }\n\n const size = (downloadData.size / 1024).toFixed(0);\n const button = DOM.download(\n downloadData,\n filename,\n `Download ${filename} (~${size} KB)`\n );\n return button;\n}","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1216,"value":"trendingTags = d3.json(\n `https://greynoise-intelligence.github.io/labs-viz-data/trending-tags.json`\n)","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1235,"value":"function calendar({ date = Plot.identity, inset = 0.5, ...options } = {}) {\n let D;\n return {\n fy: {\n transform: (data) =>\n (D = Plot.valueof(data, date, Array)).map((d) => d.getUTCFullYear())\n },\n x: { transform: () => D.map((d) => d3.utcWeek.count(d3.utcYear(d), d)) },\n y: { transform: () => D.map((d) => d.getUTCDay()) },\n inset,\n ...options\n };\n}","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1233,"value":"class MonthLine extends Plot.Mark {\n static defaults = { stroke: \"currentColor\", strokeWidth: 1 };\n constructor(data, options = {}) {\n const { x, y } = options;\n super(\n data,\n { x: { value: x, scale: \"x\" }, y: { value: y, scale: \"y\" } },\n options,\n MonthLine.defaults\n );\n }\n render(index, { x, y }, { x: X, y: Y }, dimensions) {\n const { marginTop, marginBottom, height } = dimensions;\n const dx = x.bandwidth(),\n dy = y.bandwidth();\n return htl.svg`\n `${\n Y[i] > marginTop + dy * 1.5 // is the first day a Monday?\n ? `M${X[i] + dx},${marginTop}V${Y[i]}h${-dx}`\n : `M${X[i]},${marginTop}`\n }V${height - marginBottom}`\n ).join(\"\")}>`;\n }\n}","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1009,"value":"import { kevTagHeatmap } from \"1a7ef0ccee095db2\"","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1220,"value":"import { bar, table } from \"@hamzaamjad/tiny-charts\"","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1270,"value":"tagAgg2 = tagsDB.sql`SELECT\n created_at,\n substring(created_at, 1, 4) AS year,\n count(*) as tagCt\nFROM tags\nGROUP BY 1, 2\nORDER BY 2, 1\n`","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"},{"id":1409,"value":"html`\n`","pinned":false,"hidden":false,"mode":"ojs","author":"$undefined","summary":"$undefined","output":"$undefined","database":"$undefined"}],"files":"$W35","stdlib":"1","titling":"auto"}} 30:"$2f:body"