CISA KEV Batch CVE Triage

Match up to 500 CVE IDs to the CISA KEV catalog. Get explicit listed/not-in-catalog status, ransomware flags and CISA due dates in one report.

What this Actor does

Provide 1–500 CVE identifiers. Duplicates are collapsed before matching. asOf only changes the due-date comparison date; the source is the current catalog, not a historical reconstruction. One catalog request per report.

Price

$0.10 per completed report, covering up to 500 input entries. Only the report-completed event is used. No additional start fee, per-row fee, or platform-usage pass-through is configured. A valid completed report with no matches or no changes is still one report. Invalid input or an upstream failure does not trigger our report event. Free-plan executions do not establish creator revenue.

Input example

{
  "cves": [
    "CVE-2021-44228"
  ]
}

Input fields: cves; optional asOf (YYYY-MM-DD). See .actor/INPUT_SCHEMA.json and the record details above. Overall input is limited to 1 MB. Unknown top-level fields are rejected.

Output and integration

The default dataset contains one JSON report with nested rows, not one dataset item per input. The same report is stored under key-value record OUTPUT. RUN_SUMMARY states completion, row count and local/SDK billing acknowledgment. The report includes reportId, generatedAtUtc, sourceNotice and sourceReceipts with source URL, UTC retrieval time and body SHA256 when an external source was used.

Useful fields: rows[].status, cisaDueDate, daysUntilDue, ransomwareUse, requiredAction, catalogVersion. Use JSON export to preserve types and nested arrays. Treat all returned text as untrusted text; do not inject it into HTML or spreadsheets as formulas.

// Example using the Apify client in your own integration.
const run = await client.actor('YOUR_USERNAME/kev-triage').call(input, { memory: 256, timeout: 180, maxTotalChargeUsd: 0.1 });
const output = await client.keyValueStore(run.defaultKeyValueStoreId).getRecord('OUTPUT');
const rows = output.value.rows;

Limits and interpretation

not_in_kev means absent from this snapshot, not safe. CISA dates apply within the relevant directive scope; applicability to your organization needs separate assessment. No target scanning or exploit testing is performed.

No background monitoring is started automatically. Schedule the Actor using your own Apify task if needed. No API key for the data source, paid proxy, browser, third-party subscription or external payment account is required. No official affiliation or endorsement is claimed.

Data handling

Inputs and outputs are stored in the user's Apify run storage and subject to the user's plan, retention and sharing settings. Do not submit credentials, confidential records or personal data. The Actor has no author-controlled database, analytics beacon or external log collector. Only the documented public data-source requests are made. Source data terms and attribution apply independently of the processing fee.

FAQ

Why pay when the source or local scripts are free? The fee is for the bounded batch workflow, deterministic output, validation and Apify integration. Source data remain available under their own terms.

Can I run this without contacting anyone? Yes. Use the JSON example, then adapt it to your workflow. No call, sales meeting or manual onboarding is required.

Is a failed or partial fetch a zero-match report? No. Source HTTP, timeout, schema and size failures stop the run. No report event is charged for that failed processing.

What happens if a run is restarted? A completed same-run journal returns the stored report without another report charge. If a write or charge acknowledgment is uncertain, the run stops with UNCERTAIN_OPERATION_DO_NOT_RESURRECT; inspect the existing output and charge history. It does not blindly repeat an uncertain operation. A separately started new run is a new report and may be charged.

Is this guaranteed exactly-once delivery or verified production billing? No. Apify storage and billing are separate services. The journal prioritizes avoiding duplicate charge attempts and may leave a delivered report unbilled after a crash. Local tests and public-source smoke tests do not prove platform billing, Docker execution or Store approval. Source and platform outages remain possible.

Local use

npm ci --ignore-scripts --registry=https://registry.npmjs.org
npm run check
npm test
npm run smoke:offline
npm run smoke

Tests use synthetic fixtures and do not contact external services. smoke:offline exercises the real Apify SDK with an isolated local storage directory. smoke makes at most one request for the supplied external-source example; run-audit needs none. These local commands do not push, publish or deploy.