CVE Remediation Prioritizer: CISA KEV + EPSS & Ransomware Triage

Enterprise-grade vulnerability triage and automated patch prioritization engine. Ingests raw scanner logs, firewalls, and free-text CVE lists, instantly validates identifiers, enriches them against CISA KEV active exploits and FIRST.org EPSS scores in sub-seconds, and delivers an immediate deterministic patch SLA.

Bypasses bloated commercial vulnerability platforms, requires zero third-party API keys, and runs on pure serverless architecture with built-in token optimization for LLMs and autonomous agents.

---

Key Capabilities

• Noise-Resistant Regex Parser: Ingests unformatted, raw copy-paste logs (Nessus, Qualys, terminal dumps). Extracts valid identifiers and isolates malformed inputs into alert signals.
• Deterministic UTRP Scoring: Combines real-world exploitation probability (EPSS) with active exploitation status (CISA KEV) into a unified 0–100 remediation index.
• Overdue Federal Compliance (BOD 22-01): Automatically flags expired federal remediation deadlines as immediate regulatory emergencies.
• Native Agentic & SOAR Support: Outputs pre-digested single-line summaries for LLMs (llm_summary) alongside flat webhook objects for n8n, Slack, and Jira automation.

💡 Performance Note for Enterprise Workloads: The default memory allocation (128MB) flawlessly handles standard logs and up to ~1,000 CVEs. If you are dumping massive raw SIEM logs (e.g., 5MB+ of text) to process 10,000+ items, go to Run options before starting and increase memory to 256MB, 512MB or More. This prevents Python Out-Of-Memory (OOM) errors during regex extraction.

---

Quick Start

Paste dirty console logs, raw firewall alerts, or comma-separated CVEs. The sanitization engine automatically deduplicates and standardizes identifiers:

{
  "raw_input": "Audit log host-01: detected CVE-2024-3400 and CVE 2023 4966. Flag old log4j CVE-2021-44228. Parsing artifact: invalidcve88595.",
  "days_delta": 0,
  "max_items": 100
}

---

The Decision Engine: UTRP Score

Rather than relying solely on static CVSS base metrics, the engine computes the Unified Threat Remediation Priority (UTRP) score (0 to 100):

UTRP = round((EPSS * 50) + (50 if Active CISA KEV Exploit else 0))

Remediation SLA Tiers

• REGULATORY EMERGENCY (Score 50–100): Vulnerability listed in CISA KEV with an overdue federal compliance remediation deadline (dueDate < today). Requires immediate operational mitigation.
• CRITICAL (Score 60–100): Verified in CISA KEV with an active remediation window and an EPSS >= 0.20 (20%+ exploitation likelihood). Remediation SLA: 24–48 hours.
• HIGH (Score 50–60): Verified in CISA KEV with an active remediation window and an EPSS < 0.20. Remediation SLA: 7 business days.
• MEDIUM (Score 18–50): Not listed in CISA KEV, but demonstrates an elevated threat profile (EPSS >= 0.35). Prioritize in standard sprint/patch cycle.
• LOW (Score 0–17): Not listed in CISA KEV with low in-the-wild exploitation activity (EPSS < 0.35). Backlog maintenance.
• INPUT ERROR (Score 0): Malformed or unrecognized identifier. Pushed to the top of the dataset to alert operators without breaking ingestion pipelines.

---

Input Parameters

Parameter	Type	Default	Description
raw_input	String	""	Free-text string, messy console output, or vulnerability lists. Sanitized and deduplicated automatically.
days_delta	Integer	0	Automated lookback: pulls CVEs added to CISA KEV in the last X days. Merges with raw_input (set to 0 to process only manual input).
only_active_exploits	Boolean	false	When enabled, filters out non-KEV vulnerabilities, returning only active exploits.
max_items	Integer	100	Safety threshold enforcing the maximum number of CVE records processed per execution.

---

Output Architecture

Dataset Item Schema

Every record in the output dataset contains granular enrichment data, a pre-formatted LLM context string, and a flattened webhook payload:

{
  "cve_id": "CVE-2024-3400",
  "utrp_score": 100,
  "priority": "REGULATORY EMERGENCY",
  "active_exploit": true,
  "ransomware_status": "Confirmed",
  "epss_score": 0.99999,
  "llm_summary": "CVE-2024-3400 | Priority: REGULATORY EMERGENCY | Score: 100 | KEV: Yes | Ransomware: Confirmed",
  "webhook_payload": {
    "cve_id": "CVE-2024-3400",
    "utrp_score": 100,
    "priority": "REGULATORY EMERGENCY",
    "active_exploit": true,
    "ransomware_status": "Confirmed",
    "epss_score": 0.99999,
    "summary": "CVE-2024-3400 | Priority: REGULATORY EMERGENCY | Score: 100 | KEV: Yes | Ransomware: Confirmed"
  }
}

Malformed Input Alert Schema

Malformed tokens are isolated and reported directly in the dataset:

{
  "cve_id": "⚠️ INVALID: invalidcve88595",
  "utrp_score": 0,
  "priority": "INPUT ERROR",
  "active_exploit": false,
  "ransomware_status": "N/A",
  "epss_score": 0.0,
  "llm_summary": "REJECTED: 'invalidcve88595' is malformed. Target identifier must follow standard format: CVE-YYYY-NNNN."
}

---

Automation & Integrations

1. n8n Workflow Automation

Streamline remediation workflows directly inside n8n without custom API scripting. Review the Apify n8n Integration Guide to connect your account.

• Trigger: Webhook, Schedule (Cron), or Security Alert.
• Apify Node: Select action Run Actor and wait for completion using mnss0/cve-remediation-prioritizer.
• If / Switch Node Routing:
  • $json.priority == 'REGULATORY EMERGENCY': Route directly to Slack / PagerDuty.
  • $json.priority == 'CRITICAL': Assign to SecOps for immediate review.
  • $json.priority == 'HIGH': Assign to IT Ops for 7-day SLA.
  • $json.priority == 'INPUT ERROR': Route warning to reporter.
  • Else: Push structured findings into Jira / Linear for standard maintenance.

2. Apify Webhook Configuration

Set up direct HTTP dispatching to your SIEM, SOAR, or custom endpoints under the Integrations tab:

1. Click Integrations -> Add integration -> HTTP request / Webhook.
2. Start when: Select Run succeeded.
3. URL: Enter your receiver endpoint (e.g., n8n Webhook URL or AWS Lambda).
4. Payload Template: Use Apify variable interpolation to route results directly:

   {
     "actor_id": {{userId}},
     "run_id": {{eventData.actorRunId}},
     "dataset_url": "[https://api.apify.com/v2/datasets/](https://api.apify.com/v2/datasets/){{resource.defaultDatasetId}}/items?format=json"
   }
   

3. Model Context Protocol (MCP) & AI Agents

Connect this Actor directly as a live tool in Cursor, Claude Desktop, or LangChain agents via the Apify MCP server:

• MCP Direct URL: https://mcp.apify.com/?tools=actors,docs,mnss0/cve-remediation-prioritizer
• Zero-Shot Prompt Example:

  "Triage the following vulnerability scan and prioritize patches: [paste raw log]. Return the top 3 highest priority items using the llm_summary field, and list any rejected input tokens."

---

Transparent Pricing (Pay-Per-Event)

Designed for cost-effective CI/CD pipelines, daily automated SOC sweeps, and agentic queries. You only pay for verified, enriched items:

• Initialization Fee: $0.00005 per run.
• Enrichment Fee: $0.0015 per validated, processed CVE.
• Billing Example: Triaging a vulnerability report with 1,000 CVEs costs ~$1.50 ($0.00005 base + $1.50 data processing).