CSAF Advisory Extractor

What does CSAF Advisory Extractor do?

Point it at any OASIS CSAF 2.0 / VEX provider or aggregator (BSI/CERT-Bund, Red Hat, Siemens, Cisco and other publishers) and get structured security advisories as a clean dataset. Every conforming publisher exposes advisories the same way, through a provider-metadata.json, so one Actor covers all of them without a per-vendor scraper.

Modes

Mode	One row per…
advisories (default)	advisory × vulnerability × affected product, with CVE, CWE, per-product CVSS score and remediation joined on
discover	distribution feed (for a provider) or listed provider (for an aggregator). A cheap way to map a publisher before pulling documents

Input

• startUrl (required): a provider domain (e.g. https://wid.cert-bund.de), a direct provider-metadata.json, or an aggregator.json.
• mode: advisories or discover.
• since: only advisories updated on or after this ISO date.
• maxRecords: cap on rows emitted (default 1000).
• maxProviders: how many providers to follow from an aggregator (default 10).
• tlpFilter: white_clear (default, only freely redistributable TLP:WHITE/CLEAR advisories) or all for a provider you are authorised to redistribute in full.
• userAgent, timeoutSecs: optional request tuning.

Example:

{
  "startUrl": "https://wid.cert-bund.de/.well-known/csaf-aggregator/aggregator.json",
  "mode": "discover",
  "maxRecords": 50
}

Output

Advisory rows include trackingId, documentTitle, publisherName, tlpLabel, release dates, aggregateSeverity, cve, cweId, productStatus, productId, productName, cvssBaseScore, cvssBaseSeverity, cvssVectorString, remediationCategory, remediationDetails and remediationUrl. Optional fields are null when the advisory does not state them. You can download the dataset as JSON, CSV, Excel or HTML.

Behaviour

• Handles both CSAF distribution types: ROLIE feeds and directory_url distributions (changes.csv / index.txt), and follows redirects and cross-host feed URLs.
• A reachable provider with no advisories in the window is a real zero. A start URL that does not resolve to CSAF metadata fails with exit code 91 instead of returning an empty dataset.

Pricing and budget control

Pay per event: one record event per row written (US$0.0005 per record on the FREE tier, lower on paid tiers).

Each row is billed as it is written. Set Max total charge on the run to cap spend: the Actor writes only the rows that budget pays for, then stops fetching feeds and advisories. If the budget cannot pay for a single row, no request is sent. If billing fails, the run stops with an error and writes nothing further; rows already paid for stay in the dataset.

Notes

This Actor reads public CSAF metadata and advisories that publishers release for machine consumption. It is not affiliated with OASIS or any publisher. Respect each publisher's TLP labels and terms.