# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install production-ready libraries
pip install requests paramiko python-dotenv pydantic

# Initialize project
npm init -y

# Install dependencies
npm install axios dotenv node-ssh zod
# For TypeScript support
npm install --save-dev typescript ts-node @types/node

import os
import paramiko
from dotenv import load_dotenv
from pydantic import BaseModel, Field
from typing import Optional

# Load environment variables from .env file
load_dotenv()

class ScanResult(BaseModel):
    """Schema for validated scan results"""
    hostname: str
    is_vulnerable: bool
    detected_version: str
    status: str = "success"
    error_message: Optional[str] = None

class CiscoScanner:
    def __init__(self, host, username, password):
        self.host = host
        self.username = username
        self.password = password

    def check_version(self, secure_version: str) -> ScanResult:
        """
        Connects via SSH and checks the software version.
        In a real PoC scenario, this would check specific patch levels.
        """
        client = paramiko.SSHClient()
        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        
        try:
            client.connect(self.host, username=self.username, password=self.password, timeout=10)
            
            # Command to check Cisco software version
            stdin, stdout, stderr = client.exec_command("show version | include Cisco IOS")
            version_output = stdout.read().decode('utf-8').strip()
            
            # Logic: If the detected version is less than the secure version
            # This is a simplified comparison for demonstration
            is_vulnerable = version_output < secure_version
            
            return ScanResult(
                hostname=self.host,
                is_vulnerable=is_vulnerable,
                detected_version=version_output or "Unknown"
            )

        except Exception as e:
            return ScanResult(
                hostname=self.host,
                is_vulnerable=False, # Assume safe if we can't reach it, or handle as 'unknown'
                detected_version="N/A",
                status="error",
                error_message=str(e)
            )
        finally:
            client.close()

if __name__ == "__main__":
    # Configuration (Loaded from Environment)
    TARGET_HOST = os.getenv("CISCO_TARGET_HOST", "192.168.1.10")
    SECURE_VER = os.getenv("SECURE_VERSION", "12.5(1)S")
    
    scanner = CiscoScanner(
        host=TARGET_HOST,
        username=os.getenv("CISCO_USER"),
        password=os.getenv("CISCO_PASS")
    )
    
    result = scanner.check_version(SECURE_VER)
    print(f"Scan Result: {result.model_dump_json(indent=2)}")

import axios from 'axios';
import * as dotenv from 'dotenv';
import { z } from 'zod';

dotenv.config();

// Define the schema for our security report
const ScanSchema = z.object({
  ip: z.string().ip(),
  vulnerable: z.boolean(),
  version: z.string(),
  timestamp: z.string(),
});

type ScanReport = z.infer<typeof ScanSchema>;

class CiscoSecurityMonitor {
  private baseUrl: string;
  private apiKey: string;

  constructor() {
    this.baseUrl = process.env.CISCO_API_URL || 'https://localhost:8443';
    this.apiKey = process.env.CISCO_API_KEY || '';
  }

  /**
   * Checks the Cisco Unified CM API for patch status
   */
  async verifyPatchStatus(ip: string, minVersion: string): Promise<ScanReport> {
    try {
      // In a real scenario, we query the Cisco AXL or Web API
      const response = await axios.get(`${this.baseUrl}/api/v1/system/version`, {
        headers: { 'Authorization': `Bearer ${this.apiKey}` },
        timeout: 5000,
        // Note: In production, use proper CA certs instead of allowUnauthorized
        httpsAgent: new (require('https').Agent)({ rejectUnauthorized: false })
      });

      const currentVersion = response.data.version;
      const isVulnerable = currentVersion < minVersion;

      // Validate data against our schema before returning
      return ScanSchema.parse({
        ip,
        vulnerable: isVulnerable,
        version: currentVersion,
        timestamp: new Date().toISOString(),
      });

    } catch (error) {
      console.error(`[ERROR] Failed to scan ${ip}:`, error instanceof Error ? error.message : error);
      throw error;
    }
  }
}

// Execution Logic
async function run() {
  const monitor = new CiscoSecurityMonitor();
  try {
    const report = await monitor.verifyPatchStatus('192.168.1.50', '12.5(1)S');
    console.log('✅ Scan Complete:', JSON.stringify(report, null, 2));
  } catch (err) {
    console.error('❌ Scan Failed');
  }
}

run();

# Cisco Connection Details
CISCO_TARGET_HOST=10.0.5.20
CISCO_USER=svc_security_scanner
CISCO_PASS=SuperSecretPassword123!

# API Configuration
CISCO_API_URL=https://ucm-cluster.internal:8443
CISCO_API_KEY=your_api_token_here

# Security Baseline
SECURE_VERSION=12.5(1)S

.env
node_modules/
__pycache__/
venv/

# Python pattern for resilient connections
import time

def resilient_connect(scanner, retries=3):
    for i in range(retries):
        try:
            return scanner.connect()
        except Exception:
            time.sleep(2 ** i) # Wait 1s, 2s, 4s...
    raise Exception("Max retries exceeded")

// TypeScript pattern for controlled concurrency
import pLimit from 'p-limit';

const limit = pLimit(5); // Only 5 concurrent scans at a time
const scanTasks = ips.map(ip => limit(() => monitor.verifyPatchStatus(ip, '12.5')));
const results = await Promise.all(scanTasks);