OT/ICS Advisory Matcher — CISA Alerts For Your Equipment

Apify cannot touch a PLC on a factory network — scanning industrial control systems is out of reach and out of scope for a cloud platform, and rightly so. But CISA publishes advisories for the vendors that build that equipment, and that feed is public, structured, and entirely legal to consume.

An OT/plant-engineering team's real daily problem isn't "scan our network" — it's "which of this week's 40 CISA advisories touch equipment we actually have installed?" Feed this a vendor/product list; get back only the matches, ranked by severity, with the CVE and a plain-language next step.

Entirely passive. No scanning, no login — CISA's own RSS feed and the official CSAF structured advisory format.

How it works

1. Fetch CISA's ICS advisories feed. Public RSS, updated continuously.
2. Cheap title-only match first — most advisories won't touch most asset lists, so only real candidates get the expensive step.
3. Fetch the full CSAF JSON for candidates — the official structured advisory format, with CVE IDs, CVSS scores, and vendor names.
4. Rank by urgency, not just severity — a CVSS 10.0 CRITICAL on equipment you run is act_this_week; a lower score is track.

Input

{ "assets": ["Rockwell Automation", "Siemens SIMATIC"] }

List the vendors/products actually installed at your site. Matching is on vendor and product name, word-boundary (not substring) — "Rockwell" won't false-positive-match "Rockwell Collins."

Sample output

{
  "advisoryId": "icsa-26-123-01",
  "title": "Siemens SIMATIC IoT2050 Vulnerabilities",
  "matchedAsset": "Siemens",
  "cves": "CVE-2026-58115",
  "cvssScore": 10.0,
  "severity": "CRITICAL",
  "urgency": "act_this_week",
  "note": "Critical severity on equipment you run. Read the advisory and apply the vendor's mitigation or patch.",
  "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-123-01"
}

Typical uses

• Weekly plant-engineering check — run against your actual equipment list; get only what's relevant, ranked by urgency.
• OT security team triage — replace manually scanning 30-40 advisories a week for the handful that matter.
• Vendor risk tracking — watch a specific vendor's advisory history over time.

Pricing

$3.00 / 1,000 results ($0.003 per matched advisory).

⚠️ Read before you act

• Matching is on vendor/product name text. CISA advisory titles vary in how they name equipment — a clean result reduces risk but does not guarantee your exact model was never mentioned. Widen your asset list if unsure.
• This does not scan your network. It only tells you which published, public advisories mention equipment you told it you run. It cannot know what you actually have installed.
• Re-run weekly. New advisories publish continuously; this is a point-in-time snapshot, not a subscription (pair it with a schedule).

FAQ

• Does this touch my OT network at all? No. Every request goes to CISA's own public feed — nothing ever reaches your infrastructure.
• What if my vendor isn't in the results? Either nothing recent was published for them, or the advisory names the product differently than you searched. Try broader/alternate terms.
• Why two passes (title, then CSAF)? The title-only pass is nearly free; only real candidates trigger the more expensive structured-data fetch, keeping the actor fast and cheap on quiet weeks.

Related actors

• Dependency Vulnerability Advisor — the same triage idea for software packages instead of industrial equipment.
• Sanctions Screening — another official-feed-matched-against-your-list pattern, for OFAC/UN watchlists instead of CVEs.