Add Microsoft CSAF in the sources

[Rafiot]

https://msrc.microsoft.com/csaf/provider-metadata.json

[jonite]

While adding MSFT, could you also add NCSC-NL CSAF?
https://vulnerabilities.ncsc.nl/csaf/

[cedricbonhomme]

While adding MSFT, could you also add NCSC-NL CSAF? https://vulnerabilities.ncsc.nl/csaf/

Just to mention that we do have sightings from NCSC-NL:
https://vulnerability.circl.lu/sightings/?query=ncsc

[Rafiot]

That's what happen when trying to load Microsoft CSAF, investigating further.

{"time":"2024-11-19T14:41:39+01:00","level":"INFO","msg":"AdvisoryFileProcessor.Process: \"https://msrc.microsoft.com/csaf/changes.csv\" has an invalid time stamp in line 91: parsing time \"2024-11-12T08:00:00.0000000\" as \"2006-01-02T15:04:05Z07:00\": cannot parse \"\" as \"Z07:00\""}

gocsaf/csaf#588

[Rafiot]

@jonite just checking, in case ou know: the CSAF from NCSC NL seems to be a clone of the NVD. Is there anything else in there?

[jonite]

Thanks for looking into it, the advisory feed is probably a better option then:
https://advisories.ncsc.nl/csaf/

After publication of CSAF 2.1 advisories are created also in that standard. Further, new features will be added in the 2.1 version, likely including also a new score. As part of the change it is also planned to change the assessment method for advisories from probability/severity to urgency with three proposed levels.

[Rafiot]

sounds good, and you also have your own IDs, which makes things easier to manage. I'll work on that asap.

[Rafiot]

Fixed by 60f0e49