Security / CTI Enrichment Pack

Correlate vulnerability and threat data across free open-security feeds in one run: NVD CVEs, CIRCL recent CVEs, and URLhaus malware URLs. One flat, typed dataset. Free open threat data — no API key, no proxy.

What it does

Threat analysts usually juggle three or four dashboards to answer "what's the current CVE exposure for X, and what malicious URLs are trending?" This Actor fuses the key open feeds into one queryable output.

• Search NVD by CPE or keyword (log4j, cpe:2.3:a:apache:tomcat).
• Pull the most recent CVEs from CIRCL.
• Pull recent malicious URLs from URLhaus.

Features

• NVD — official US NIST CVE database; returns ID, CVSS severity, published date, description.
• CIRCL CVE API — most-recent CVEs with CVSS and summaries.
• URLhaus — recent malware URLs (CSV feed from abuse.ch), parsed into typed rows.
• Per-source coverage summary — every run emits a RUN_SUMMARY row listing what was checked and how many hits each source returned.
• No API key, no proxy — all sources are free open-security endpoints.

What people use it for

• Vulnerability triage — enumerate CVEs for a product you run.
• Threat-intel feeds — pipe recent CVEs / malware URLs into a SIEM or alerting.
• Daily exposure digest — schedule a run and watch new CVEs for your stack.
• Incident response — confirm whether a flagged CVE or URL is known.

Understanding the fields

Field	Meaning
source	NVD / CIRCL / URLhaus / RUN_SUMMARY
id	CVE ID or URLhaus ID
severity	CVSS base severity (NVD/CIRCL) or threat type (URLhaus)
published	Publication / addition date
detail	Description or URL
attribution	Source credit

Input

All fields optional; sensible defaults produce a working run.

Field	Type	Default	What it does
cpeQuery	string	log4j	CPE 2.3 string or keyword for NVD search.
recentCount	integer	10	Number of recent CVEs to pull from CIRCL (1–50).
includeNvd	boolean	true	Search NVD for the query.
includeCircl	boolean	true	Pull recent CVEs from CIRCL.
includeUrlhaus	boolean	true	Pull recent malware URLs from URLhaus.
maxResultsPerSource	integer	10	Cap per source (1–50).

Input example

{
  "cpeQuery": "log4j",
  "recentCount": 10,
  "includeNvd": true,
  "includeCircl": true,
  "includeUrlhaus": true,
  "maxResultsPerSource": 10
}

Output

One record per threat hit, plus a RUN_SUMMARY row.

{
  "query": "log4j",
  "source": "NVD",
  "id": "CVE-2021-44228",
  "severity": "CRITICAL",
  "published": "2021-12-10T00:00:00.000",
  "detail": "Apache Log4j2 JNDI features...",
  "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "attribution": "NVD (NIST, public domain)"
}

Export the dataset as JSON, CSV, Excel, XML or JSONL from the Console, or pull it programmatically through the Apify API.

How to use it

1. Click Try for free (or Start if you already have an Apify account).
2. Fill in the input fields above — the defaults already produce a working run.
3. Press Start and watch the log; results stream into the dataset as they are found.
4. When the run finishes, open the Output tab and export as JSON, CSV or Excel.

Runs can be scheduled (hourly, daily, weekly) and wired into Slack, Google Sheets, Zapier, Make, webhooks or your own backend. Everything the Console does is also available over the Apify API.

Proxy configuration

Not needed. All sources are free public open-security endpoints that do not block datacenter IPs.

Pricing

This Actor is billed on Apify's pay-per-event model: a small charge when a run starts, plus a charge for each result written to the dataset. You only pay for records you actually receive. Current rates are shown on the Pricing tab.

FAQ

Do I need an API key?

No. NVD, CIRCL, and URLhaus are free open services.

Is the data authoritative?

Yes — NVD is the US government CVE database; CIRCL and URLhaus are widely used open threat feeds.

Why a coverage summary row?

So you can tell "no matches" from "a source failed" — the RUN_SUMMARY row reports per-source hit counts explicitly.

Other Actors by cynix_dev

Actor	What it does
Pharma / Biotech Intelligence Pack	FDA, ClinicalTrials.gov and MedlinePlus genetics in one actor.
ClinicalTrials.gov Extractor	ClinicalTrials.gov v2 API as typed study records.

Legal and responsible use

This Actor collects only publicly available information. You are responsible for how you use the data, including compliance with the target site's Terms of Service, robots directives, copyright, and data protection law such as GDPR and CCPA. Do not use it to gather personal data without a lawful basis.

Support and feedback

Found a bug, hit a site change, or need an extra field? Open a ticket on the Issues tab of this Actor — issues are read and fixed. Feature requests and custom-scraper enquiries are welcome through the same channel.