# CISA Cybersecurity & ICS Advisories Scraper (`ninhothedev/cisa-advisories-scraper`) Actor

$0.75/1K 🔥 CISA Advisories! Stream ICS & cybersecurity advisories with CVEs & mitigations. No key. JSON, CSV, Excel or API in seconds. Keep your OT/ICS defenses ahead of threats ⚡

- **URL**: https://apify.com/ninhothedev/cisa-advisories-scraper.md
- **Developed by:** [ninhothedev](https://apify.com/ninhothedev) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.75 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## CISA Cybersecurity & ICS Advisories Scraper

Scrape **CISA's advisory *publications*** — Cybersecurity Advisories, ICS
Advisories, ICS-Medical Advisories and Alerts — straight from CISA's public RSS
feeds. Every item is enriched with the parsed **advisory ID**, **advisory
type**, **vendors/products**, extracted **CVE IDs + count**, a clean HTML-stripped
summary and an ISO-8601 publish date. **No API key. No login.**

> Estimated cost: **~$0.5 per 1,000 advisories** (lightweight RSS + parsing).

### How is this different from `cisa-kev-scraper`?

They cover **two different CISA products** — get both:

| | This actor — **CISA Advisories** | [cisa-kev-scraper](https://apify.com/ninhothedev/cisa-kev-scraper) |
|---|---|---|
| Source | CISA advisory **publications** (RSS feeds) | CISA **Known Exploited Vulnerabilities (KEV)** catalog |
| Unit of data | An **advisory document** (ICSA-24-123-01, AA24-123A, …) | A **single exploited CVE** entry |
| Content | Titles, vendors/products, all referenced CVEs, summaries, ICS/medical/joint types | CVE, vendor/product, date added, due date, ransomware flag |
| Answers | *"What did CISA just publish about ICS/OT and which products/CVEs does it touch?"* | *"Which CVEs are being actively exploited right now?"* |

In short: **KEV = the actively-exploited CVE list; this actor = the advisory
write-ups CISA publishes** (many of which are ICS/OT advisories that never enter
KEV). Use them together for full coverage.

### What it collects

Combined **All-Advisories** feed and a dedicated **ICS-Advisories** feed. Each
record:

```json
{
  "type": "advisory",
  "advisory_id": "ICSA-26-218-01",
  "title": "ABB Ability Zenon",
  "advisory_type": "ICS Advisory",
  "summary": "Summary ATN-B1 CPDLC relies on legacy clear text ...",
  "vendors": [],
  "products": ["ABB Ability Zenon"],
  "cve_ids": ["CVE-2026-0001", "CVE-2026-0002"],
  "cve_count": 2,
  "published": "2026-08-06T12:00:00+00:00",
  "categories": [],
  "link": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-218-01",
  "guid": "/node/25270",
  "source": "cisa",
  "scraped_at": "2026-08-11T00:00:00+00:00"
}
```

**Advisory-type derivation** (from the parsed ID): `ICSA-*` → *ICS Advisory*,
`ICSMA-*` → *ICS Medical*, `AA*` → *Cybersecurity Advisory*, otherwise → *Alert*
(e.g. KEV-catalog news posts, which carry no advisory ID).

### Input

| Field | Type | Description |
|---|---|---|
| `mode` | select | `advisories` (combined feed, all types) or `ics` (ICS feed only). |
| `advisoryTypeFilter` | select | `any` / `ics` / `medical` / `cybersecurity` / `alert`. |
| `cveFilter` | string | Keep advisories whose CVE IDs contain this substring (e.g. `CVE-2025`). |
| `vendorFilter` | string | Keep advisories whose vendor/product/title contains this substring (e.g. `Siemens`). |
| `sinceDays` | integer | Keep advisories published within the last N days. |
| `maxItems` | integer | Cap on pushed records (default 500, max 5000). |

### Use cases

- **OT / ICS security monitoring** — track new ICSA/ICSMA advisories for the
  vendors and products in your environment.
- **Threat intelligence** — enrich a feed with CISA's authoritative advisories
  and their referenced CVEs.
- **Vendor advisory tracking** — filter to a vendor and watch what CISA publishes.
- **SOC feeds** — drop fresh advisories (with CVEs) into your SIEM/ticketing.

### Notes, caveats & data source

- **Keyless & authoritative.** Data comes from CISA's own RSS feeds
  (`/cybersecurity-advisories/all.xml` and `ics-advisories.xml`). The feeds
  return roughly the **30 most recent** items each, so this actor is built for
  *fresh monitoring*, not full-history backfill.
- **Vendors/products** are best-effort. CISA titles do **not** use a strict
  `Vendor: Product` convention, so `vendors` is populated only when a title
  clearly splits on a colon; for ICS/ICS-medical advisories the full title is
  kept in `products` (it *is* the affected-product string). CVE data is exact
  (regex over title + description).
- **CSAF JSON.** CISA also publishes many ICS advisories in machine-readable
  [CSAF 2.0](https://github.com/cisagov/CSAF) (vendor/product trees, CVSS
  vectors). Those files are reachable keyless and referenced from each advisory
  page; this actor sticks to the RSS feeds for speed and full coverage across
  all advisory types. Ask if you want CSAF enrichment added.

### Related actors by the same author

- [cisa-kev-scraper](https://apify.com/ninhothedev/cisa-kev-scraper) — CISA Known Exploited Vulnerabilities catalog.
- [epss-scores-scraper](https://apify.com/ninhothedev/epss-scores-scraper) — EPSS exploitation-probability scores.
- [github-advisories-scraper](https://apify.com/ninhothedev/github-advisories-scraper) — GitHub Security Advisories.
- [mitre-attack-scraper](https://apify.com/ninhothedev/mitre-attack-scraper) — MITRE ATT\&CK techniques.

# Actor input Schema

## `mode` (type: `string`):

Which CISA feed to scrape. 'advisories' pulls the combined All-Advisories feed (every type). 'ics' pulls only the ICS-Advisories feed (ICSA-\* / ICSMA-\*).

## `advisoryTypeFilter` (type: `string`):

Keep only advisories of this derived type. 'any' keeps everything; 'ics' = ICS Advisory (ICSA-*), 'medical' = ICS Medical (ICSMA-*), 'cybersecurity' = joint Cybersecurity Advisory (AA\*), 'alert' = alerts / KEV notices without an advisory ID.

## `cveFilter` (type: `string`):

Optional. Keep only advisories whose extracted CVE IDs contain this substring, e.g. 'CVE-2025' for a whole year or a full 'CVE-2025-71409'. Case-insensitive.

## `vendorFilter` (type: `string`):

Optional. Keep only advisories whose vendor, product or title contains this substring, e.g. 'Siemens' or 'Schneider'. Case-insensitive.

## `sinceDays` (type: `integer`):

Optional. Keep only advisories published within the last N days (based on the RSS pubDate). Leave empty for no date limit.

## `maxItems` (type: `integer`):

Maximum number of advisories to push to the dataset. The RSS feeds return roughly the 30 most recent items per feed.

## Actor input object example

```json
{
  "mode": "advisories",
  "advisoryTypeFilter": "any",
  "maxItems": 500
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("ninhothedev/cisa-advisories-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("ninhothedev/cisa-advisories-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call ninhothedev/cisa-advisories-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,ninhothedev/cisa-advisories-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/zKhhzvSquVZZ7ovpH/builds/sSxcFMArmm0VrdlkM/openapi.json