EPSS::Query
A pure value object describing one query to the FIRST EPSS API.
All filter fields are optional. The struct is immutable; use with
methods to derive a new query (q.with_date(...), q.with_cves(...)).
Encode to a query-string fragment with #to_params. The EPSS::Client
uses this internally and is the usual caller — but the struct is
exposed publicly so consumers can build URLs without going through
the HTTP client (useful for caching layers and offline tooling).
Constructors
CVEs whose EPSS probability is strictly above threshold. Defaults
to the 0.95 cutoff commonly used by tier-1 triage policies.
CVEs whose EPSS probability is strictly below threshold. Pair
with above for inverse filters.
Build a query that filters by a single CVE id. Sugar for the
common case where with_cves([cve]) would otherwise be required.
EPSS::Query.for_cve("CVE-2022-27225")
Restrict results to scores published in the last days days.
Maps to the FIRST days parameter rather than client-side
filtering.
Free-text search query, sorted by EPSS descending.
EPSS::Query.search("openssl")
Instance methods
CVE IDs to filter on. Normalized to upper-case at construction so
comparisons against query.cves are predictable; the FIRST API
itself is case-insensitive on CVE ids. The list is joined with ,
at request time.
Force the FIRST envelope wrapper. The EPSS endpoint already wraps
responses by default, but envelope=false can be requested to
receive a bare data array — set this explicitly when you want to
override the server's default behavior.
Comma-separated list of fields to return. Maps to FIRST's global
fields query param — request a projected payload (e.g.
"cve,epss") to skip percentile/date when the caller doesn't need
them.
Request pretty-printed JSON. Off by default (extra whitespace is wasted bandwidth for programmatic consumers); set when capturing API responses to disk for human review.
Encode this query as an array of {key, value} URL parameter pairs,
ready to be passed to URI::Params.encode. Returns only the fields
that are set — never emits a parameter with an empty value.
Compose this query into a URL path + query string suitable for the
FIRST API endpoint (relative form). The host is supplied by Client.
Singular form of with_cves. Mirrors Query.for_cve for fluent
chains where a Query already exists.