CISA Cybersecurity & ICS Advisories Scraper

Scrape CISA's advisory publications — Cybersecurity Advisories, ICS Advisories, ICS-Medical Advisories and Alerts — straight from CISA's public RSS feeds. Every item is enriched with the parsed advisory ID, advisory type, vendors/products, extracted CVE IDs + count, a clean HTML-stripped summary and an ISO-8601 publish date. No API key. No login.

Estimated cost: ~$0.5 per 1,000 advisories (lightweight RSS + parsing).

How is this different from cisa-kev-scraper?

They cover two different CISA products — get both:

	This actor — CISA Advisories	cisa-kev-scraper
Source	CISA advisory publications (RSS feeds)	CISA Known Exploited Vulnerabilities (KEV) catalog
Unit of data	An advisory document (ICSA-24-123-01, AA24-123A, …)	A single exploited CVE entry
Content	Titles, vendors/products, all referenced CVEs, summaries, ICS/medical/joint types	CVE, vendor/product, date added, due date, ransomware flag
Answers	"What did CISA just publish about ICS/OT and which products/CVEs does it touch?"	"Which CVEs are being actively exploited right now?"

In short: KEV = the actively-exploited CVE list; this actor = the advisory write-ups CISA publishes (many of which are ICS/OT advisories that never enter KEV). Use them together for full coverage.

What it collects

Combined All-Advisories feed and a dedicated ICS-Advisories feed. Each record:

{
  "type": "advisory",
  "advisory_id": "ICSA-26-218-01",
  "title": "ABB Ability Zenon",
  "advisory_type": "ICS Advisory",
  "summary": "Summary ATN-B1 CPDLC relies on legacy clear text ...",
  "vendors": [],
  "products": ["ABB Ability Zenon"],
  "cve_ids": ["CVE-2026-0001", "CVE-2026-0002"],
  "cve_count": 2,
  "published": "2026-08-06T12:00:00+00:00",
  "categories": [],
  "link": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-218-01",
  "guid": "/node/25270",
  "source": "cisa",
  "scraped_at": "2026-08-11T00:00:00+00:00"
}

Advisory-type derivation (from the parsed ID): ICSA-* → ICS Advisory, ICSMA-* → ICS Medical, AA* → Cybersecurity Advisory, otherwise → Alert (e.g. KEV-catalog news posts, which carry no advisory ID).

Input

Field	Type	Description
mode	select	advisories (combined feed, all types) or ics (ICS feed only).
advisoryTypeFilter	select	any / ics / medical / cybersecurity / alert.
cveFilter	string	Keep advisories whose CVE IDs contain this substring (e.g. CVE-2025).
vendorFilter	string	Keep advisories whose vendor/product/title contains this substring (e.g. Siemens).
sinceDays	integer	Keep advisories published within the last N days.
maxItems	integer	Cap on pushed records (default 500, max 5000).

Use cases

• OT / ICS security monitoring — track new ICSA/ICSMA advisories for the vendors and products in your environment.
• Threat intelligence — enrich a feed with CISA's authoritative advisories and their referenced CVEs.
• Vendor advisory tracking — filter to a vendor and watch what CISA publishes.
• SOC feeds — drop fresh advisories (with CVEs) into your SIEM/ticketing.

Notes, caveats & data source

• Keyless & authoritative. Data comes from CISA's own RSS feeds (/cybersecurity-advisories/all.xml and ics-advisories.xml). The feeds return roughly the 30 most recent items each, so this actor is built for fresh monitoring, not full-history backfill.
• Vendors/products are best-effort. CISA titles do not use a strict Vendor: Product convention, so vendors is populated only when a title clearly splits on a colon; for ICS/ICS-medical advisories the full title is kept in products (it is the affected-product string). CVE data is exact (regex over title + description).
• CSAF JSON. CISA also publishes many ICS advisories in machine-readable CSAF 2.0 (vendor/product trees, CVSS vectors). Those files are reachable keyless and referenced from each advisory page; this actor sticks to the RSS feeds for speed and full coverage across all advisory types. Ask if you want CSAF enrichment added.

Related actors by the same author

• cisa-kev-scraper — CISA Known Exploited Vulnerabilities catalog.
• epss-scores-scraper — EPSS exploitation-probability scores.
• github-advisories-scraper — GitHub Security Advisories.
• mitre-attack-scraper — MITRE ATT&CK techniques.