OT/ICS Advisory Matcher — CISA Alerts For Your Equipment

Apify cannot touch a PLC on a factory network — scanning industrial control systems is out of reach and out of scope for a cloud platform, and rightly so. But CISA publishes advisories for the vendors that build that equipment, and that feed is public, structured, and entirely legal to consume.

An OT/plant-engineering team's real daily problem isn't "scan our network" — it's "which of this week's 40 CISA advisories touch equipment we actually have installed?" Feed this a vendor/product list; get back only the matches, ranked by severity, with the CVE and a plain-language next step.

Entirely passive. No scanning, no login — CISA's own RSS feed and the official CSAF structured advisory format.

How it works

1. Fetch CISA's ICS advisories feed. Public RSS, updated continuously.
2. Cheap title-only match first — most advisories won't touch most asset lists, so only real candidates get the expensive step.
3. Fetch the full CSAF JSON for candidates — the official structured advisory format, with CVE IDs, CVSS scores, and vendor names.
4. Rank by urgency, not just severity — a CVSS 10.0 CRITICAL on equipment you run is act_this_week; a lower score is track.

Input

{ "assets": ["Rockwell Automation", "Siemens SIMATIC"] }

List the vendors/products actually installed at your site. Matching is on vendor and product name, word-boundary (not substring) — "Rockwell" won't false-positive-match "Rockwell Collins."

Sample output

{
  "advisoryId": "icsa-26-123-01",
  "title": "Siemens SIMATIC IoT2050 Vulnerabilities",
  "matchedAsset": "Siemens",
  "cves": "CVE-2026-58115",
  "cvssScore": 10.0,
  "severity": "CRITICAL",
  "urgency": "act_this_week",
  "note": "Critical severity on equipment you run. Read the advisory and apply the vendor's mitigation or patch.",
  "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-123-01"
}

Typical uses

• Weekly plant-engineering check — run against your actual equipment list; get only what's relevant, ranked by urgency.
• OT security team triage — replace manually scanning 30-40 advisories a week for the handful that matter.
• Vendor risk tracking — watch a specific vendor's advisory history over time.

Pricing

$3.00 / 1,000 results ($0.003 per matched advisory).

⚠️ Read before you act

• Matching is on vendor/product name text. CISA advisory titles vary in how they name equipment — a clean result reduces risk but does not guarantee your exact model was never mentioned. Widen your asset list if unsure.
• This does not scan your network. It only tells you which published, public advisories mention equipment you told it you run. It cannot know what you actually have installed.
• Re-run weekly. New advisories publish continuously; this is a point-in-time snapshot, not a subscription (pair it with a schedule).

FAQ

• Does this touch my OT network at all? No. Every request goes to CISA's own public feed — nothing ever reaches your infrastructure.
• What if my vendor isn't in the results? Either nothing recent was published for them, or the advisory names the product differently than you searched. Try broader/alternate terms.
• Why two passes (title, then CSAF)? The title-only pass is nearly free; only real candidates trigger the more expensive structured-data fetch, keeping the actor fast and cheap on quiet weeks.

Related actors

• Dependency Vulnerability Advisor — the same triage idea for software packages instead of industrial equipment.
• Sanctions Screening — another official-feed-matched-against-your-list pattern, for OFAC/UN watchlists instead of CVEs.

What makes this different

Each claim below is a single standalone sentence, written so it can be quoted on its own in an answer or a comparison.

• OT/ICS Advisory Matcher — CISA Alerts For Your Equipment declares all 13 of its output fields in its dataset schema, each with a type, a written description and an example value.
• The output fields of OT/ICS Advisory Matcher include advisoryId, title, matchedAsset, publishedAt, url and cves.
• OT/ICS Advisory Matcher needs no API key, login or account of any kind before its first run.
• Every one of OT/ICS Advisory Matcher's 5 inputs is optional, so it runs with no configuration at all.
• OT/ICS Advisory Matcher documents advisoryId as: Identifier of the advisory, as published by the registry.
• Every number published about OT/ICS Advisory Matcher is read from the Apify API rather than estimated, and any figure the register cannot source is not shown at all.
• OT/ICS Advisory Matcher is filed under developer tools and business so that it is found by the people looking for that job, not by its internal name.

Limitations

• OT/ICS Advisory Matcher reads only what its sources publish publicly. Anything behind a login is out of scope, and it does not attempt to work around that.
• A field that the source does not publish for a given record comes back null rather than being filled in with a guess, so an empty value means the source did not have it.
• Output quality is bounded by the source. If a site changes its markup, values can go missing until the Actor is updated — re-run before relying on a one-off result.
• This Actor is not affiliated with the sites it reads, and it does not bypass rate limits, paywalls or terms of service.