# CVE Remediation Prioritizer: CISA KEV + EPSS Triage (`mnss0/cve-remediation-prioritizer`) Actor

Real-time CVE triage engine. Unifies CISA KEV active exploits, ransomware campaigns & FIRST.org EPSS scores into an actionable UTRP patch priority. Bypasses heavy scanners with sub-second lookups. Zero API keys, zero proxies. MCP & n8n automation ready for SOC teams and AI agents.

- **URL**: https://apify.com/mnss0/cve-remediation-prioritizer.md
- **Developed by:** [Vinicius Minosso](https://apify.com/mnss0) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.50 / 1,000 enriched cve records

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CVE Remediation Prioritizer: CISA KEV + EPSS & Ransomware Triage

Enterprise-grade vulnerability triage and automated patch prioritization engine. Ingests raw scanner logs, firewalls, and free-text CVE lists, instantly validates identifiers, enriches them against **CISA KEV** active exploits and **FIRST.org EPSS** scores in sub-seconds, and delivers an immediate deterministic patch SLA.

Bypasses bloated commercial vulnerability platforms, requires zero third-party API keys, and runs on pure serverless architecture with built-in token optimization for LLMs and autonomous agents.

***

#### Key Capabilities

- **Noise-Resistant Regex Parser:** Ingests unformatted, raw copy-paste logs (Nessus, Qualys, terminal dumps). Extracts valid identifiers and isolates malformed inputs into alert signals.
- **Deterministic UTRP Scoring:** Combines real-world exploitation probability (EPSS) with active exploitation status (CISA KEV) into a unified 0–100 remediation index.
- **Overdue Federal Compliance (BOD 22-01):** Automatically flags expired federal remediation deadlines as immediate regulatory emergencies.
- **Native Agentic & SOAR Support:** Outputs pre-digested single-line summaries for LLMs (`llm_summary`) alongside flat webhook objects for n8n, Slack, and Jira automation.

> 💡 **Performance Note for Enterprise Workloads:**
> The default memory allocation (128MB) flawlessly handles standard logs and up to ~1,000 CVEs. If you are dumping massive raw SIEM logs (e.g., 5MB+ of text) to process 10,000+ items, go to **Run options** before starting and increase memory to **256MB, 512MB or More**. This prevents Python Out-Of-Memory (OOM) errors during regex extraction.

***

#### Quick Start

Paste dirty console logs, raw firewall alerts, or comma-separated CVEs. The sanitization engine automatically deduplicates and standardizes identifiers:

```json
{
  "raw_input": "Audit log host-01: detected CVE-2024-3400 and CVE 2023 4966. Flag old log4j CVE-2021-44228. Parsing artifact: invalidcve88595.",
  "days_delta": 0,
  "max_items": 100
}
```

***

#### The Decision Engine: UTRP Score

Rather than relying solely on static CVSS base metrics, the engine computes the **Unified Threat Remediation Priority (UTRP)** score (0 to 100):

`UTRP = round((EPSS * 50) + (50 if Active CISA KEV Exploit else 0))`

##### Remediation SLA Tiers

- **REGULATORY EMERGENCY (Score 50–100):** Vulnerability listed in CISA KEV with an overdue federal compliance remediation deadline (`dueDate < today`). Requires immediate operational mitigation.
- **CRITICAL (Score 60–100):** Verified in CISA KEV with an active remediation window and an EPSS >= 0.20 (20%+ exploitation likelihood). Remediation SLA: **24–48 hours**.
- **HIGH (Score 50–60):** Verified in CISA KEV with an active remediation window and an EPSS < 0.20. Remediation SLA: **7 business days**.
- **MEDIUM (Score 18–50):** Not listed in CISA KEV, but demonstrates an elevated threat profile (EPSS >= 0.35). Prioritize in standard sprint/patch cycle.
- **LOW (Score 0–17):** Not listed in CISA KEV with low in-the-wild exploitation activity (EPSS < 0.35). Backlog maintenance.
- **INPUT ERROR (Score 0):** Malformed or unrecognized identifier. Pushed to the top of the dataset to alert operators without breaking ingestion pipelines.

***

#### Input Parameters

| Parameter | Type | Default | Description |
|---|---|---|---|
| `raw_input` | String | `""` | Free-text string, messy console output, or vulnerability lists. Sanitized and deduplicated automatically. |
| `days_delta` | Integer | `0` | Automated lookback: pulls CVEs added to CISA KEV in the last X days. Merges with `raw_input` (set to `0` to process only manual input). |
| `only_active_exploits` | Boolean | `false` | When enabled, filters out non-KEV vulnerabilities, returning only active exploits. |
| `max_items` | Integer | `100` | Safety threshold enforcing the maximum number of CVE records processed per execution. |

***

#### Output Architecture

##### Dataset Item Schema

Every record in the output dataset contains granular enrichment data, a pre-formatted LLM context string, and a flattened webhook payload:

```json
{
  "cve_id": "CVE-2024-3400",
  "utrp_score": 100,
  "priority": "REGULATORY EMERGENCY",
  "active_exploit": true,
  "ransomware_status": "Confirmed",
  "epss_score": 0.99999,
  "llm_summary": "CVE-2024-3400 | Priority: REGULATORY EMERGENCY | Score: 100 | KEV: Yes | Ransomware: Confirmed",
  "webhook_payload": {
    "cve_id": "CVE-2024-3400",
    "utrp_score": 100,
    "priority": "REGULATORY EMERGENCY",
    "active_exploit": true,
    "ransomware_status": "Confirmed",
    "epss_score": 0.99999,
    "summary": "CVE-2024-3400 | Priority: REGULATORY EMERGENCY | Score: 100 | KEV: Yes | Ransomware: Confirmed"
  }
}
```

##### Malformed Input Alert Schema

Malformed tokens are isolated and reported directly in the dataset:

```json
{
  "cve_id": "⚠️ INVALID: invalidcve88595",
  "utrp_score": 0,
  "priority": "INPUT ERROR",
  "active_exploit": false,
  "ransomware_status": "N/A",
  "epss_score": 0.0,
  "llm_summary": "REJECTED: 'invalidcve88595' is malformed. Target identifier must follow standard format: CVE-YYYY-NNNN."
}
```

***

#### Automation & Integrations

##### 1. n8n Workflow Automation

Streamline remediation workflows directly inside n8n without custom API scripting. Review the [Apify n8n Integration Guide](https://docs.apify.com/integrations/n8n) to connect your account.

- **Trigger:** Webhook, Schedule (Cron), or Security Alert.
- **Apify Node:** Select action `Run Actor and wait for completion` using `mnss0/cve-remediation-prioritizer`.
- **If / Switch Node Routing:**
  - `$json.priority == 'REGULATORY EMERGENCY'`: Route directly to Slack / PagerDuty.
  - `$json.priority == 'CRITICAL'`: Assign to SecOps for immediate review.
  - `$json.priority == 'HIGH'`: Assign to IT Ops for 7-day SLA.
  - `$json.priority == 'INPUT ERROR'`: Route warning to reporter.
  - `Else`: Push structured findings into Jira / Linear for standard maintenance.

##### 2. Apify Webhook Configuration

Set up direct HTTP dispatching to your SIEM, SOAR, or custom endpoints under the **Integrations** tab:

1. Click **Integrations** -> **Add integration** -> **HTTP request / Webhook**.
2. **Start when:** Select `Run succeeded`.
3. **URL:** Enter your receiver endpoint (e.g., n8n Webhook URL or AWS Lambda).
4. **Payload Template:** Use Apify variable interpolation to route results directly:
   ```json
   {
     "actor_id": {{userId}},
     "run_id": {{eventData.actorRunId}},
     "dataset_url": "[https://api.apify.com/v2/datasets/](https://api.apify.com/v2/datasets/){{resource.defaultDatasetId}}/items?format=json"
   }
   ```

##### 3. Model Context Protocol (MCP) & AI Agents

Connect this Actor directly as a live tool in Cursor, Claude Desktop, or LangChain agents via the Apify MCP server:

- **MCP Direct URL:** `https://mcp.apify.com/?tools=actors,docs,mnss0/cve-remediation-prioritizer`
- **Zero-Shot Prompt Example:**
  > *"Triage the following vulnerability scan and prioritize patches: \[paste raw log]. Return the top 3 highest priority items using the llm\_summary field, and list any rejected input tokens."*

***

#### Transparent Pricing (Pay-Per-Event)

Designed for cost-effective CI/CD pipelines, daily automated SOC sweeps, and agentic queries. You only pay for verified, enriched items:

- **Initialization Fee:** $0.00005 per run.
- **Enrichment Fee:** $0.0015 per validated, processed CVE.
- **Billing Example:** Triaging a vulnerability report with 1,000 CVEs costs **~$1.50** ($0.00005 base + $1.50 data processing).

# Actor input Schema

## `raw_input` (type: `string`):

Paste unstructured logs (Nessus, OpenVAS, Qualys), security reports, or comma-separated CVE IDs. The engine's regex parser will automatically extract and deduplicate valid identifiers.

## `only_active_exploits` (type: `boolean`):

Strict filtering: Return ONLY vulnerabilities currently armed and exploited in the wild according to the CISA KEV catalog.

## `days_delta` (type: `integer`):

Limit the scope to vulnerabilities added to the CISA KEV catalog within the last specified days. Ideal for daily automated SOC cron jobs.

## `max_items` (type: `integer`):

Safety threshold: Maximum number of CVEs to enrich and push to the dataset per run to control Pay-Per-Event billing.

## Actor input object example

```json
{
  "raw_input": "Vulnerability scan detected CVE-2024-3400 and CVE-2023-46604 in perimeter firewalls. Legacy alert: CVE-2021-44228.",
  "only_active_exploits": false,
  "days_delta": 0,
  "max_items": 100
}
```

# Actor output Schema

## `defaultDatasetId` (type: `string`):

The unique identifier of the default dataset where the processed CVE records are stored.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "raw_input": "Vulnerability scan detected CVE-2024-3400 and CVE-2023-46604 in perimeter firewalls. Legacy alert: CVE-2021-44228."
};

// Run the Actor and wait for it to finish
const run = await client.actor("mnss0/cve-remediation-prioritizer").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "raw_input": "Vulnerability scan detected CVE-2024-3400 and CVE-2023-46604 in perimeter firewalls. Legacy alert: CVE-2021-44228." }

# Run the Actor and wait for it to finish
run = client.actor("mnss0/cve-remediation-prioritizer").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "raw_input": "Vulnerability scan detected CVE-2024-3400 and CVE-2023-46604 in perimeter firewalls. Legacy alert: CVE-2021-44228."
}' |
apify call mnss0/cve-remediation-prioritizer --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,mnss0/cve-remediation-prioritizer"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Nhy78IZEBgq7L5PTX/builds/y4PFuX7vFL53zjT5a/openapi.json