# CISA KEV & EPSS Vulnerability Vendor Impact Monitor (`afkdigital/cisa-kev-epss-vulnerability-vendor-impact-monitor`) Actor

Join official CISA exploited CVEs with FIRST EPSS probabilities. Filter vendors, products, score and KEV dates. Dated, deduplicated JSON/CSV for Clay and n8n.

- **URL**: https://apify.com/afkdigital/cisa-kev-epss-vulnerability-vendor-impact-monitor.md
- **Developed by:** [AFK Digital](https://apify.com/afkdigital) (community)
- **Categories:** Developer tools, Automation
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$5.00 / 1,000 unique cve delivereds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CISA KEV & EPSS Vulnerability Vendor Impact Monitor

Turn the official CISA Known Exploited Vulnerabilities catalog into vendor-focused, dated JSON and CSV records enriched with FIRST EPSS. Use it for defensive vulnerability triage, vendor watchlists, security dashboards, Clay enrichment and n8n workflows. No source API key, browser, proxy or login is required.

### What you get

One row per unique CVE, with CISA vendor/project, product, vulnerability name, KEV addition date, catalog due date, required action, EPSS probability, EPSS percentile, actual score date, source links and UTC retrieval time. Source text is preserved; results are sorted by KEV addition date descending and then CVE descending. This is a fresh snapshot each run, not a historical change detector or a scan of your systems.

**KEV and EPSS answer different questions.** CISA lists CVEs with evidence of exploitation in the wild. FIRST EPSS forecasts the probability that exploitation activity for a CVE will be observed in the next 30 days, as of the score date. A percentile is a relative ranking, not an exploitation probability. A low EPSS score does not undo the evidence behind KEV inclusion. Scores are population-level estimates, not a prediction for your organization.

**Vendor or product matches are text matches only.** They are not proof that a customer's system contains a vulnerable version, is affected, was exploited or is compromised. Confirm asset inventory, version, configuration, exposure and vendor advisories separately.

**Due-date scope.** due_date is copied from CISA's catalog dueDate without recalculation. CISA's current KEV guidance refers to BOD 26-04 for federal civilian executive branch (FCEB) remediation requirements. Applicable timelines can depend on asset exposure and other directive conditions. A catalog date alone is not a computed asset-specific compliance deadline. It is not a universal private-sector legal obligation. Always consult the current directive and the source entry, including notes and any forensic triage guidance.

### Input

```json
{"vendor":"Microsoft","product":"Windows","minEpssScore":0.1,"addedWithinDays":0,"maxResults":20,"maxCostUsd":0.10}
```

| Field | Default | Meaning |
| --- | --- | --- |
| vendor | empty | Case-insensitive literal substring of vendorProject |
| product | empty | Case-insensitive literal substring of product; AND with vendor |
| minEpssScore | 0 | Inclusive probability threshold from 0 to 1, not percentile |
| addedWithinDays | 0 | Inclusive UTC calendar-day KEV addition cutoff; 0 disables |
| maxResults | 20 | Unique CVE output cap, 1–5,000 |
| maxCostUsd | 1 | Total per-run event-cost cap, $0–$25; whole events rounded down |

Empty vendor/product strings match all values. Aliases, fuzzy matching, CPE/version analysis and asset scans are not performed. maxResults is an upper bound, not a promise of that many matches. Broad text filters can match several product families. Newest KEV additions appear first; results are not ranked by EPSS.

Missing EPSS is **null**, never zero. With minEpssScore=0, missing scores remain in the output; positive thresholds exclude them because they cannot satisfy a known minimum. A successful empty API response can represent missing scores. HTTP, timeout, malformed data, schema and inconsistent score-date errors fail the run rather than silently becoming nulls. FIRST may publish yesterday's score; epss_score_date records the actual returned date, never the fetch date. The first nonempty batch establishes a score date, pinned for all later batches.

### Output fields

| Field | Meaning |
| --- | --- |
| cve_id | Exact CVE join key |
| vendor_project | CISA vendorProject |
| product_name | CISA product |
| vulnerability_name | CISA vulnerabilityName |
| date_added_kev | CISA dateAdded, YYYY-MM-DD |
| due_date | Unmodified CISA dueDate; scope explained above |
| epss_probability_score | Number 0–1, or null |
| epss_percentile | Number 0–1, or null |
| required_action | Unmodified CISA requiredAction |
| epss_score_date | Actual FIRST score date, or null |
| source_url | Official CISA JSON catalog URL |
| fetched_at | UTC time after the relevant EPSS response |
| epss_source_url | FIRST per-CVE query, with score date when known |
| is_known_exploited | true: listed by CISA, not proof of local compromise |

The SUMMARY key-value record includes catalog version/release date, candidates, returned count, prior CVEs on resume, EPSS date, request count and elapsed seconds. Empty results are a successful run with an empty Dataset and a summary, not an error row.

### Clay, n8n and API exports

Run the Actor, then download its Dataset as JSON or CSV. Output links are exposed in the Output tab. In Clay, import the CSV or use HTTP API enrichment; in n8n, call the Actor and fetch Dataset items after it succeeds. Keep your Apify API token in the integration's secret storage.

```text
POST https://api.apify.com/v2/acts/ACTOR_ID/runs?maxTotalChargeUsd=0.10
Authorization: Bearer YOUR_APIFY_TOKEN
Content-Type: application/json

{"vendor":"Apache","product":"Log4j","maxResults":10,"maxCostUsd":0.05}

GET https://api.apify.com/v2/datasets/DATASET_ID/items?format=json&clean=true
GET https://api.apify.com/v2/datasets/DATASET_ID/items?format=csv&clean=true
```

JSON preserves null explicitly; CSV exports represent nulls as empty cells. Check run status and SUMMARY before consuming results from a failed or aborted run, which can contain an incomplete set of already delivered rows.

### Price and limits

**$0.005 per successful unique CVE delivered — $5 per 1,000 CVEs.** One custom cve-returned event per saved row. No paid Actor-start, source-request, retry, empty-result or duplicate event. Standard-run platform usage is included in this price. The per-run bill is limited by maxResults, maxCostUsd and the user's Apify maxTotalChargeUsd spending limit. The lowest cap wins. For example, 20 rows cost $0.10; a $0.017 budget allows 3 rows ($0.015).

Deduplication is by CVE ID within a run, including reading existing Dataset IDs when the same run is resumed/resurrected. Source request retries do not emit rows or charges. A newly started run is a new snapshot and bills its delivered CVEs again. Storage/export operations outside the Actor follow Apify's platform rules.

HTTP requests use 20-second timeouts, up to 4 attempts for transient errors, bounded exponential backoff and Retry-After handling. EPSS batches keep the comma-separated CVE parameter below 1,800 characters, safely below FIRST's documented 2,000-character maximum; requests are sequential with at least 250ms spacing, far below the documented 1,000 public requests/minute. No parallel fan-out. The source-processing deadline is 210 seconds, with a 240-second default run timeout. Runs fail explicitly on exhausted sources. No numeric CISA feed quota was found in the reviewed official documentation; the Actor fetches the catalog once per run and respects 429 responses. Prefer scheduled snapshots over rapid polling.

### Sources, attribution and terms

- CISA official JSON: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- CISA JSON Schema: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities_schema.json
- Catalog and entry context: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Current federal directive: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA's official mirror documents CC0/public-domain use, identical to the canonical KEV license: https://github.com/cisagov/kev-data and https://www.cisa.gov/sites/default/files/licenses/kev/license.txt
- EPSS data and attribution: FIRST EPSS Special Interest Group; scores generated by Empirical Security. https://www.first.org/epss/data.html and https://www.first.org/epss/faq
- FIRST public EPSS API, response schema and parameter reference: https://api.first.org/epss/ ; general API/rate limits: https://api.first.org/
- FIRST states EPSS scores are freely published via CSV/API without registration and requests attribution in products/publications. Source data is publicly available for free; this Actor charges for retrieval, filtering, joining, normalization, dated provenance and Apify delivery, not exclusive access to the underlying data. No endorsement by CISA, FIRST or Empirical Security is implied.
- FIRST's current daily bulk alternative, not used by this Actor: https://epss.empiricalsecurity.com/epss_scores-current.csv.gz (gzip CSV: cve, epss, percentile, with score/model date in the comment header).

Source/API terms checked 2026-11-02. Upstream availability, schemas, publication schedules and policies may change. This product is a defensive information workflow, not a vulnerability scanner, exploit tool, compliance determination or guarantee of completeness.

# Actor input Schema

## `vendor` (type: `string`):

Case-insensitive literal substring of CISA vendorProject. Empty matches all. Does not prove your assets are affected.

## `product` (type: `string`):

Case-insensitive literal substring of CISA product. ANDed with vendor. Empty matches all.

## `minEpssScore` (type: `number`):

Inclusive probability threshold, 0–1. At 0, retain missing scores as null. A positive threshold excludes unknown scores. Not percentile.

## `addedWithinDays` (type: `integer`):

UTC calendar-day cutoff, inclusive. 0 disables this filter. Uses KEV dateAdded, not CVE publication date.

## `maxResults` (type: `integer`):

Maximum returned and billed unique CVEs per run, newest KEV additions first. A resumed run counts already saved CVEs toward this cap.

## `maxCostUsd` (type: `number`):

Total per-run result budget at $0.005/CVE, rounded down to whole events. Apify platform spending limit also applies. No start fee; standard-run platform usage included.

## Actor input object example

```json
{
  "vendor": "",
  "product": "",
  "minEpssScore": 0,
  "addedWithinDays": 0,
  "maxResults": 20,
  "maxCostUsd": 1
}
```

# Actor output Schema

## `json` (type: `string`):

No description

## `csv` (type: `string`):

No description

## `summary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("afkdigital/cisa-kev-epss-vulnerability-vendor-impact-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("afkdigital/cisa-kev-epss-vulnerability-vendor-impact-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call afkdigital/cisa-kev-epss-vulnerability-vendor-impact-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,afkdigital/cisa-kev-epss-vulnerability-vendor-impact-monitor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/r1LTncLEe1g7GoEUI/builds/tem9jirrJCxcIrLdD/openapi.json