# OT/ICS Advisory Matcher — CISA Alerts For Your Equipment (`alaudinburki/ics-advisory-matcher`) Actor

Match CISA ICS advisories against the equipment vendors and products you actually run. Only the advisories that touch your assets, ranked by CVSS severity with the CVE and a plain-language next step. Entirely passive — no scanning of your network required or performed.

- **URL**: https://apify.com/alaudinburki/ics-advisory-matcher.md
- **Developed by:** [alaudin burki](https://apify.com/alaudinburki) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $3.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## OT/ICS Advisory Matcher — CISA Alerts For Your Equipment

Apify cannot touch a PLC on a factory network — scanning industrial control
systems is out of reach and out of scope for a cloud platform, and rightly
so. But CISA publishes advisories for the **vendors that build that
equipment**, and that feed is public, structured, and entirely legal to
consume.

An OT/plant-engineering team's real daily problem isn't "scan our network" —
it's **"which of this week's 40 CISA advisories touch equipment we actually
have installed?"** Feed this a vendor/product list; get back only the
matches, ranked by severity, with the CVE and a plain-language next step.

**Entirely passive.** No scanning, no login — CISA's own RSS feed and the
official CSAF structured advisory format.

### How it works

1. **Fetch CISA's ICS advisories feed.** Public RSS, updated continuously.
2. **Cheap title-only match first** — most advisories won't touch most
   asset lists, so only real candidates get the expensive step.
3. **Fetch the full CSAF JSON** for candidates — the official structured
   advisory format, with CVE IDs, CVSS scores, and vendor names.
4. **Rank by urgency**, not just severity — a CVSS 10.0 CRITICAL on
   equipment you run is `act_this_week`; a lower score is `track`.

### Input

```json
{ "assets": ["Rockwell Automation", "Siemens SIMATIC"] }
```

List the vendors/products actually installed at your site. Matching is on
vendor and product name, word-boundary (not substring) — "Rockwell" won't
false-positive-match "Rockwell Collins."

### Sample output

```json
{
  "advisoryId": "icsa-26-123-01",
  "title": "Siemens SIMATIC IoT2050 Vulnerabilities",
  "matchedAsset": "Siemens",
  "cves": "CVE-2026-58115",
  "cvssScore": 10.0,
  "severity": "CRITICAL",
  "urgency": "act_this_week",
  "note": "Critical severity on equipment you run. Read the advisory and apply the vendor's mitigation or patch.",
  "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-123-01"
}
```

### Typical uses

- **Weekly plant-engineering check** — run against your actual equipment
  list; get only what's relevant, ranked by urgency.
- **OT security team triage** — replace manually scanning 30-40 advisories
  a week for the handful that matter.
- **Vendor risk tracking** — watch a specific vendor's advisory history
  over time.

### Pricing

**$3.00 / 1,000 results** (`$0.003` per matched advisory).

### ⚠️ Read before you act

- **Matching is on vendor/product name text.** CISA advisory titles vary in
  how they name equipment — a clean result reduces risk but does not
  guarantee your exact model was never mentioned. Widen your asset list if
  unsure.
- **This does not scan your network.** It only tells you which *published,
  public* advisories mention equipment you told it you run. It cannot know
  what you actually have installed.
- **Re-run weekly.** New advisories publish continuously; this is a
  point-in-time snapshot, not a subscription (pair it with a schedule).

### FAQ

- **Does this touch my OT network at all?** No. Every request goes to
  CISA's own public feed — nothing ever reaches your infrastructure.
- **What if my vendor isn't in the results?** Either nothing recent was
  published for them, or the advisory names the product differently than
  you searched. Try broader/alternate terms.
- **Why two passes (title, then CSAF)?** The title-only pass is nearly
  free; only real candidates trigger the more expensive structured-data
  fetch, keeping the actor fast and cheap on quiet weeks.

### Related actors

- **Dependency Vulnerability Advisor** — the same triage idea for software
  packages instead of industrial equipment.
- **Sanctions Screening** — another official-feed-matched-against-your-list
  pattern, for OFAC/UN watchlists instead of CVEs.

# Actor input Schema

## `assets` (type: `array`):

The equipment vendors and product lines actually installed at your site, e.g. Rockwell Automation, Siemens SIMATIC, Schneider Electric. Only advisories mentioning these are returned.

## `maxAdvisoriesToScan` (type: `integer`):

How many of the most recent CISA ICS advisories to check.

## `fetchFullDetail` (type: `boolean`):

For each title match, fetch the official structured CSAF advisory for the CVE ID and severity score. Turning this off is faster but only returns the title match, no severity.

## `concurrency` (type: `integer`):

How many advisories to check in parallel.

## `maxItems` (type: `integer`):

Hard cap on matched advisories returned. You are never charged beyond this.

## Actor input object example

```json
{
  "assets": [
    "Rockwell Automation",
    "Siemens"
  ],
  "maxAdvisoriesToScan": 150,
  "fetchFullDetail": true,
  "concurrency": 8,
  "maxItems": 500
}
```

# Actor output Schema

## `results` (type: `string`):

CISA ICS advisories that mention your equipment.

## `qualityReport` (type: `string`):

Advisories scanned, match counts by urgency.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "assets": [
        "Rockwell Automation",
        "Siemens"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("alaudinburki/ics-advisory-matcher").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "assets": [
        "Rockwell Automation",
        "Siemens",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("alaudinburki/ics-advisory-matcher").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "assets": [
    "Rockwell Automation",
    "Siemens"
  ]
}' |
apify call alaudinburki/ics-advisory-matcher --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,alaudinburki/ics-advisory-matcher"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/KZZ1MeLlvC4UMi1Rd/builds/SeMLdgFVAcSoTveh1/openapi.json