# FIRST.org CSIRT Teams + EPSS Scraper (`parseforge/first-org-csirt-teams-scraper`) Actor Extract the FIRST.org global directory of Computer Security Incident Response Teams (CSIRTs): team name, country, region, host organization, constituency, members, established date, and contact channels. Export to JSON, CSV, or Excel for cybersecurity research, threat intelligence. - **URL**: https://apify.com/parseforge/first-org-csirt-teams-scraper.md - **Developed by:** [ParseForge](https://apify.com/parseforge) (community) - **Categories:** Developer tools, Other - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing from $14.00 / 1,000 result items This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ![ParseForge Banner](https://github.com/ParseForge/apify-assets/blob/ad35ccc13ddd068b9d6cba33f323962e39aed5b2/banner.jpg?raw=true) ## ๐Ÿ” FIRST.org CSIRT Teams + EPSS Scraper > ๐Ÿš€ **Export the global incident-response directory in seconds.** Pull **854 CSIRT/SOC teams across 117 countries** plus **EPSS exploit-prediction scores for 334,000+ CVEs** from the Forum of Incident Response and Security Teams. > ๐Ÿ•’ **Last updated:** 2026-05-23 ยท **๐Ÿ“Š 26 fields** per record ยท **๐Ÿ›ฐ๏ธ 854 CSIRT teams** ยท **๐ŸŒ 117 countries** ยท **๐Ÿ› 334k+ CVEs scored** The **FIRST.org CSIRT Teams + EPSS Scraper** exports the authoritative directory of computer security incident response teams (CSIRTs) maintained by FIRST.org, plus the EPSS (Exploit Prediction Scoring System) service that scores the likelihood of exploitation for every published CVE. It returns **26 fields per record**, including team name, full name, membership type, team type, host organisation, country, contact channels, PGP keys, operating hours, and constituency description. The directory covers **854 incident response teams across 117 countries**, including national CERTs, sector-specific ISACs, vendor PSIRTs, financial-services CSIRTs, and academic teams. The EPSS mode returns daily-refreshed exploit-likelihood scores and percentiles for **334,000+ CVEs**, the same model used by Fortune 500 security teams to prioritize patching. | ๐ŸŽฏ Target Audience | ๐Ÿ’ก Primary Use Cases | |---|---| | Cybersecurity teams, threat intel analysts, incident responders, vulnerability managers, CISO offices, ISAC operators, security researchers | Incident coordination, CVE prioritization, threat-intel feeds, vendor PSIRT discovery, regional CERT outreach, vulnerability triage | --- ### ๐Ÿ“‹ What the FIRST.org Scraper does Two collection modes plus filters: - ๐Ÿ›ฐ๏ธ **CSIRT teams directory.** 854 incident response teams worldwide with contact channels, PGP keys, operating hours, and constituency. - ๐Ÿ› **EPSS scores.** Daily-updated exploit-prediction scores and percentiles for 334,000+ CVEs. - ๐ŸŒ **Country filter.** Restrict the teams directory to one ISO-2 country code from a 117-country enum. - ๐Ÿ” **Team-name filter.** Free-text substring filter on team name, full name, or host organisation (case-insensitive). - ๐Ÿ†” **CVE filter.** In EPSS mode, optionally narrow to one CVE ID for targeted lookups. Each team record includes contact email, website, phone (with separate emergency number), full street address, time zone, operating hours, constituency description, PGP key ID and fingerprint, establishment date, and FIRST.org membership tenure. > ๐Ÿ’ก **Why it matters:** when an incident hits, knowing which CERT to contact in which country saves hours. When 1,000 new CVEs drop per week, EPSS tells you which ones attackers are actually exploiting. Both feeds are publicly available, but they live in different schemas at different endpoints. This Actor unifies them into one structured dataset. --- ### ๐ŸŽฌ Full Demo _๐Ÿšง Coming soon: a 3-minute walkthrough showing how to pull every European national CERT contact and load it into an incident-response runbook._ --- ### โš™๏ธ Input
InputTypeDefaultBehavior
maxItemsinteger10Records to return. Free plan caps at 10, paid plan at 1,000,000.
modestring"teams""teams" for CSIRT directory, "epss" for CVE scores.
countrystring""ISO-2 country filter for teams mode (117 supported). Empty = all.
teamFilterstring""Substring filter on team name, full name, or host (case-insensitive).
cvestring""EPSS mode only. Optional CVE ID (e.g. CVE-2024-12345).
**Example: every German CSIRT team with contact details.** ```json { "maxItems": 50, "mode": "teams", "country": "DE" } ```` **Example: EPSS scores for one specific CVE.** ```json { "maxItems": 1, "mode": "epss", "cve": "CVE-2024-3094" } ``` > โš ๏ธ **Good to Know:** EPSS scores refresh daily. A score of 0.97 means the model estimates a 97% probability that this CVE will be exploited in the next 30 days. Percentile tells you where this CVE ranks against all scored CVEs. Combine both with CVSS for full risk context. *** ### ๐Ÿ“Š Output Each record contains **26 fields** (team mode populates team fields, EPSS mode populates score fields; the other set is null). Download the dataset as CSV, Excel, JSON, or XML. #### ๐Ÿงพ Schema | Field | Type | Example | |---|---|---| | ๐Ÿ†” `id` | string | null | `"1234"` | | ๐Ÿ›ฐ๏ธ `team` | string | null | `"CERT-Bund"` | | ๐Ÿ“› `teamFull` | string | null | `"Computer Emergency Response Team for German federal agencies"` | | ๐ŸŽ–๏ธ `membership` | string | null | `"Full Member"` | | ๐Ÿท๏ธ `teamType` | string | null | `"National CSIRT"` | | ๐Ÿข `host` | string | null | `"BSI - Federal Office for Information Security"` | | ๐ŸŒ `country` | string | null | `"DE"` | | ๐Ÿ“ง `email` | string | null | `"certbund@bsi.bund.de"` | | ๐ŸŒ `website` | string | null | `"https://www.bsi.bund.de/CERT-Bund/"` | | ๐Ÿ“ž `phone` | string | null | `"+49 228 99 9582 222"` | | ๐Ÿ†˜ `phoneEmergency` | string | null | `"+49 228 99 9582 222"` | | ๐Ÿ“ฎ `address` | string | null | `"Godesberger Allee 185-189, 53175 Bonn, Germany"` | | ๐Ÿ•’ `timezone` | string | null | `"Europe/Berlin"` | | โฐ `operatingHours` | string | null | `"24x7"` | | ๐Ÿ‘ฅ `constituency` | string | null | `"German federal agencies"` | | ๐Ÿ“ `constituencyDescription` | string | null | `"All federal government agencies of Germany"` | | ๐Ÿ”‘ `pgpId` | string | null | `"0x12345678"` | | ๐Ÿ—๏ธ `pgpFingerprint` | string | null | `"ABCD 1234 EFGH..."` | | ๐Ÿ“† `establishment` | string | null | `"1994-01-01"` | | ๐ŸŽŸ๏ธ `memberSince` | string | null | `"2000-06-15"` | | ๐Ÿ• `lastModified` | ISO 8601 | null | `"2024-08-12T10:23:00"` | | ๐Ÿ› `cve` | string | null | `"CVE-2024-3094"` | | ๐Ÿ“Š `epssScore` | number | null | `0.97214` | | ๐Ÿ“ˆ `epssPercentile` | number | null | `0.99987` | | ๐Ÿ“… `epssDate` | string | null | `"2026-05-22"` | | ๐Ÿท๏ธ `mode` | string | `"teams"` | | ๐Ÿ•’ `scrapedAt` | ISO 8601 | `"2026-05-23T00:00:00.000Z"` | #### ๐Ÿ“ฆ Sample records
๐Ÿ‡ฉ๐Ÿ‡ช National CSIRT: CERT-Bund (Germany) ```json { "id": "1234", "team": "CERT-Bund", "teamFull": "Computer Emergency Response Team for German federal agencies", "membership": "Full Member", "teamType": "National CSIRT", "host": "BSI - Federal Office for Information Security", "country": "DE", "email": "certbund@bsi.bund.de", "website": "https://www.bsi.bund.de/CERT-Bund/", "phone": "+49 228 99 9582 222", "timezone": "Europe/Berlin", "operatingHours": "24x7", "constituency": "German federal agencies", "establishment": "1994-01-01", "mode": "teams", "scrapedAt": "2026-05-23T00:00:00.000Z" } ```
๐Ÿ› EPSS score: high-risk CVE ```json { "cve": "CVE-2024-3094", "epssScore": 0.97214, "epssPercentile": 0.99987, "epssDate": "2026-05-22", "mode": "epss", "scrapedAt": "2026-05-23T00:00:00.000Z" } ```
๐Ÿข Vendor PSIRT entry ```json { "team": "Cisco PSIRT", "teamFull": "Cisco Product Security Incident Response Team", "teamType": "Vendor PSIRT", "host": "Cisco Systems", "country": "US", "email": "psirt@cisco.com", "website": "https://www.cisco.com/go/psirt", "mode": "teams" } ```
*** ### โœจ Why choose this Actor | | Capability | |---|---| | ๐Ÿ›ฐ๏ธ | **854 CSIRT teams.** Every FIRST.org member team across 117 countries, with contact channels and PGP keys. | | ๐Ÿ› | **EPSS for 334k+ CVEs.** Daily-refreshed exploit-prediction scores and percentiles. | | ๐ŸŒ | **Country filter.** Restrict the directory to one of 117 ISO-2 codes. | | ๐Ÿ” | **Free-text search.** Substring filter on team name, full name, or host. | | ๐Ÿ“Š | **Full team metadata.** Type, membership, constituency, operating hours, time zone, PGP, establishment date. | | โšก | **Fast.** 100 teams in under 10 seconds. | | ๐Ÿšซ | **No authentication.** Public FIRST.org API. No login or token required. | > ๐Ÿ“Š Incident response runs on phone numbers and email addresses. EPSS turns CVE noise into a triage queue. Both should be one structured pull away. *** ### ๐Ÿ“ˆ How it compares to alternatives | Approach | Cost | Coverage | Refresh | Filters | Setup | |---|---|---|---|---|---| | **โญ FIRST.org CSIRT + EPSS Scraper** *(this Actor)* | $5 free credit, then pay-per-use | **854 teams, 334k+ CVEs** | **Live per run** | mode, country, team, CVE | โšก 2 min | | FIRST.org website manual lookup | Free | Same | Live | Browser-only | ๐Ÿข One team at a time | | Direct FIRST.org API code | Free | Same | Live | Custom code | ๐Ÿ•’ Hours of code | | Commercial threat-intel platforms | $500+/month | Broader | Live | Many | โณ Onboarding required | Pick this Actor when you want the FIRST.org directory and EPSS as structured data, with country and team filters, without writing custom client code. *** ### ๐Ÿš€ How to use 1. ๐Ÿ“ **Sign up.** [Create a free account with $5 credit](https://console.apify.com/sign-up?fpr=vmoqkp) (takes 2 minutes). 2. ๐ŸŒ **Open the Actor.** Go to the FIRST.org CSIRT Teams + EPSS Scraper page on the Apify Store. 3. ๐ŸŽฏ **Set input.** Pick `mode` (teams or epss), optionally filter by country, team name, or CVE, and set `maxItems`. 4. ๐Ÿš€ **Run it.** Click **Start** and let the Actor collect your data. 5. ๐Ÿ“ฅ **Download.** Grab your results in the **Dataset** tab as CSV, Excel, JSON, or XML. > โฑ๏ธ Total time from signup to a downloaded dataset: **3-5 minutes.** No coding required. *** ### ๐Ÿ’ผ Business use cases
#### ๐Ÿšจ Incident Response Teams - Build a country-by-country CSIRT contact runbook - 24x7 vs business-hours coverage maps - PGP key directory for encrypted IR comms - Vendor PSIRT lookup during product incidents #### ๐Ÿ› Vulnerability Management - Daily EPSS refresh into your VM platform - Patch-prioritization dashboards by EPSS score - "Top 100 most-likely-exploited CVEs" reports - Tie EPSS to your asset inventory
#### ๐Ÿ›ก๏ธ Threat Intel & SOC - Enrich IOCs with peer-CSIRT contacts - Regional threat-intel sharing maps - ISAC and sector-specific team discovery - Pre-build mutual-aid agreements #### ๐Ÿ›๏ธ Policy & Governance - National-CERT capability gap analysis - Country-by-country cyber-readiness reports - Sector coverage benchmarking - Public-private partnership mapping
*** ### ๐Ÿ”Œ Automating FIRST.org Scraper Control the scraper programmatically for scheduled runs and pipeline integrations: - ๐ŸŸข **Node.js.** Install the `apify-client` NPM package. - ๐Ÿ **Python.** Use the `apify-client` PyPI package. - ๐Ÿ“š See the [Apify API documentation](https://docs.apify.com/api/v2) for full details. The [Apify Schedules feature](https://docs.apify.com/platform/schedules) lets you trigger this Actor on any cron interval. Daily EPSS refreshes and weekly CSIRT directory refreshes are both common patterns. *** ### ๐ŸŒŸ Beyond business use cases Data like this powers more than commercial workflows. The same structured records support research, education, civic projects, and personal initiatives.
#### ๐ŸŽ“ Research and academia - Cybersecurity governance research - CSIRT-network topology studies - EPSS model-validation experiments - Coursework on global incident response #### ๐ŸŽจ Personal and creative - Build a personal "CVE of the day" feed - Side projects mapping cyber-defense capacity - Hobbyist threat-intel dashboards - CTF preparation with real CSIRT context
#### ๐Ÿค Non-profit and civic - Cyber-capacity building in developing countries - Press research on national-CERT response times - Civil-society incident coordination - Open-source community security teams #### ๐Ÿงช Experimentation - Train CVE-prioritization ML models with EPSS history - Build agent pipelines that route incidents to CSIRTs - Prototype vulnerability-triage dashboards - Test alert-fatigue reduction techniques
*** ### ๐Ÿค– Ask an AI assistant about this scraper Open a ready-to-send prompt about this ParseForge actor in the AI of your choice: - ๐Ÿ’ฌ [**ChatGPT**](https://chat.openai.com/?q=How%20do%20I%20use%20the%20FIRST.org%20CSIRT%20Teams%20EPSS%20Scraper%20by%20ParseForge%20on%20Apify%3F%20Show%20me%20input%20examples%2C%20output%20fields%2C%20common%20use%20cases%2C%20and%20how%20to%20integrate%20it%20into%20a%20workflow.) - ๐Ÿง  [**Claude**](https://claude.ai/new?q=How%20do%20I%20use%20the%20FIRST.org%20CSIRT%20Teams%20EPSS%20Scraper%20by%20ParseForge%20on%20Apify%3F%20Show%20me%20input%20examples%2C%20output%20fields%2C%20common%20use%20cases%2C%20and%20how%20to%20integrate%20it%20into%20a%20workflow.) - ๐Ÿ” [**Perplexity**](https://perplexity.ai/search?q=How%20do%20I%20use%20the%20FIRST.org%20CSIRT%20Teams%20EPSS%20Scraper%20by%20ParseForge%20on%20Apify%3F%20Show%20me%20input%20examples%2C%20output%20fields%2C%20common%20use%20cases%2C%20and%20how%20to%20integrate%20it%20into%20a%20workflow.) - ๐Ÿ…’ [**Copilot**](https://copilot.microsoft.com/?q=How%20do%20I%20use%20the%20FIRST.org%20CSIRT%20Teams%20EPSS%20Scraper%20by%20ParseForge%20on%20Apify%3F%20Show%20me%20input%20examples%2C%20output%20fields%2C%20common%20use%20cases%2C%20and%20how%20to%20integrate%20it%20into%20a%20workflow.) *** ### โ“ Frequently Asked Questions #### ๐Ÿงฉ How does it work? Pick a mode (teams or EPSS), optionally narrow by country, team name, or CVE, and click Start. The Actor pages through the FIRST.org catalog and emits a clean structured record per team or CVE. #### ๐Ÿ›ฐ๏ธ How many CSIRT teams are listed? 854 incident response teams across 117 countries at the time of writing. The directory grows as new teams join FIRST.org. #### ๐Ÿ› What is EPSS? EPSS (Exploit Prediction Scoring System) is FIRST.org's model that estimates the probability of a CVE being exploited in the next 30 days. It complements CVSS by adding real-world exploitation context. The Actor returns scores and percentiles for every published CVE. #### ๐ŸŒ Can I filter by country? Yes. Set `country` to a two-letter ISO code (e.g. `DE`, `US`, `JP`, `BR`). The dropdown lists all 117 supported codes. Leave empty for the worldwide directory. #### ๐Ÿ” Can I search teams by name? Yes. Set `teamFilter` to any substring of the team name, full name, or host organisation. The filter is case-insensitive. #### โฐ Can I schedule regular runs? Yes. Use Apify Schedules to run on any cron interval. Daily EPSS refreshes feed vulnerability-management dashboards. Weekly directory refreshes keep IR runbooks current. #### โš–๏ธ Is this data legal to use? Yes. FIRST.org publishes the teams directory and EPSS scores for public use under terms that permit programmatic access. #### ๐Ÿ’ผ Can I use this commercially? Yes. Incident-response platforms, vulnerability-management products, threat-intel services, and security consulting are all valid commercial use cases. #### ๐Ÿ’ณ Do I need a paid Apify plan? No. The free Apify plan is enough for testing and small runs (10 records per run). A paid plan lifts the limit and gives you access to scheduling, higher concurrency, and larger datasets. #### ๐Ÿ” What happens if a run fails partway? Apify retries transient errors automatically. The Actor pages through results deterministically, so a re-run picks up cleanly with the same input. #### ๐Ÿ†˜ What if I need help? Our support team is here to help. Contact us through the Apify platform or use the Tally form linked below. *** ### ๐Ÿ”Œ Integrate with any app FIRST.org CSIRT Teams + EPSS Scraper connects to any cloud service via [Apify integrations](https://apify.com/integrations): - [**Make**](https://docs.apify.com/platform/integrations/make) - Automate multi-step workflows - [**Zapier**](https://docs.apify.com/platform/integrations/zapier) - Connect with 5,000+ apps - [**Slack**](https://docs.apify.com/platform/integrations/slack) - Get run notifications in your channels - [**Airbyte**](https://docs.apify.com/platform/integrations/airbyte) - Pipe security data into your warehouse - [**GitHub**](https://docs.apify.com/platform/integrations/github) - Trigger runs from repo commits - [**Google Drive**](https://docs.apify.com/platform/integrations/drive) - Export datasets straight to Sheets You can also use webhooks to fire downstream actions when a run finishes. Push fresh EPSS scores into your SIEM, or alert your team in Slack when a new high-risk CVE crosses a threshold. *** ### ๐Ÿ”— Recommended Actors - [**๐Ÿ“จ IETF Datatracker Drafts Scraper**](https://apify.com/parseforge/ietf-datatracker-drafts-scraper) - Internet standards lifecycle - [**๐Ÿ“ W3C Standards Catalog Scraper**](https://apify.com/parseforge/w3c-standards-catalog-scraper) - Open Web specifications - [**๐Ÿ“š arXiv Scraper**](https://apify.com/parseforge/arxiv-scraper) - Open-access research papers - [**๐Ÿ“Š OEC Economic Complexity Trade Scraper**](https://apify.com/parseforge/oec-economic-complexity-trade-scraper) - International trade flows - [**๐ŸŒ Nominatim OSM Scraper**](https://apify.com/parseforge/nominatim-osm-scraper) - Geocode addresses via OpenStreetMap > ๐Ÿ’ก **Pro Tip:** browse the complete [ParseForge collection](https://apify.com/parseforge) for more reference-data scrapers. *** **๐Ÿ†˜ Need Help?** [**Open our contact form**](https://tally.so/r/BzdKgA) to request a new scraper, propose a custom data project, or report an issue. *** > **โš ๏ธ Disclaimer:** this Actor is an independent tool and is not affiliated with, endorsed by, or sponsored by FIRST.org or any of its member teams. All trademarks mentioned are the property of their respective owners. Only publicly available FIRST.org directory and EPSS data is collected. # Actor input Schema ## `maxItems` (type: `integer`): Free users: Limited to 10 items (preview). Paid users: Optional, max 1,000,000 ## `mode` (type: `string`): What to collect: CSIRT teams directory or EPSS exploit prediction scores for CVEs. ## `country` (type: `string`): Filter teams by ISO-2 country code. Leave blank for all. ## `teamFilter` (type: `string`): Filter teams whose name or host contains this substring (case-insensitive). ## `cve` (type: `string`): For EPSS mode: optional CVE ID (e.g. CVE-2025-12345). Leave blank to enumerate all scored CVEs. ## Actor input object example ```json { "maxItems": 10, "mode": "teams" } ``` # Actor output Schema ## `overview` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "maxItems": 10, "mode": "teams", "country": "", "teamFilter": "", "cve": "" }; // Run the Actor and wait for it to finish const run = await client.actor("parseforge/first-org-csirt-teams-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`๐Ÿ’พ Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // ๐Ÿ“š Want to learn more ๐Ÿ“–? Go to โ†’ https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "maxItems": 10, "mode": "teams", "country": "", "teamFilter": "", "cve": "", } # Run the Actor and wait for it to finish run = client.actor("parseforge/first-org-csirt-teams-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("๐Ÿ’พ Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # ๐Ÿ“š Want to learn more ๐Ÿ“–? Go to โ†’ https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "maxItems": 10, "mode": "teams", "country": "", "teamFilter": "", "cve": "" }' | apify call parseforge/first-org-csirt-teams-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=parseforge/first-org-csirt-teams-scraper", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "FIRST.org CSIRT Teams + EPSS Scraper", "description": "Extract the FIRST.org global directory of Computer Security Incident Response Teams (CSIRTs): team name, country, region, host organization, constituency, members, established date, and contact channels. Export to JSON, CSV, or Excel for cybersecurity research, threat intelligence.", "version": "1.0", "x-build-id": "oTEOCpEMcwSPlE3YP" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/parseforge~first-org-csirt-teams-scraper/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-parseforge-first-org-csirt-teams-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/parseforge~first-org-csirt-teams-scraper/runs": { "post": { "operationId": "runs-sync-parseforge-first-org-csirt-teams-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/parseforge~first-org-csirt-teams-scraper/run-sync": { "post": { "operationId": "run-sync-parseforge-first-org-csirt-teams-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "maxItems": { "title": "Max Items", "minimum": 1, "maximum": 1000000, "type": "integer", "description": "Free users: Limited to 10 items (preview). Paid users: Optional, max 1,000,000" }, "mode": { "title": "Mode", "enum": [ "teams", "epss" ], "type": "string", "description": "What to collect: CSIRT teams directory or EPSS exploit prediction scores for CVEs." }, "country": { "title": "Country (ISO-2)", "enum": [ "", "AD", "AE", "AL", "AM", "AR", "AT", "AU", "AZ", "BA", "BD", "BE", "BH", "BJ", "BN", "BR", "BS", "BT", "BW", "BY", "CA", "CH", "CI", "CL", "CM", "CN", "CO", "CR", "CW", "CY", "CZ", "DE", "DK", "DO", "EC", "EE", "EG", "ES", "ET", "EU", "FI", "FR", "GB", "GE", "GH", "GR", "GT", "HK", "HR", "HU", "ID", "IE", "IL", "IN", "IS", "IT", "JE", "JO", "JP", "KE", "KR", "KZ", "LI", "LK", "LT", "LU", "LV", "MA", "MC", "MD", "ME", "MK", "MN", "MO", "MT", "MU", "MW", "MX", "MY", "NA", "NG", "NL", "NO", "NZ", "OM", "PA", "PE", "PH", "PK", "PL", "PR", "PT", "QA", "RO", "RS", "RU", "RW", "SA", "SD", "SE", "SG", "SI", "SK", "SV", "TG", "TH", "TN", "TR", "TW", "TZ", "UA", "UG", "US", "UY", "UZ", "VN", "ZA", "ZM" ], "type": "string", "description": "Filter teams by ISO-2 country code. Leave blank for all." }, "teamFilter": { "title": "Team name contains", "type": "string", "description": "Filter teams whose name or host contains this substring (case-insensitive)." }, "cve": { "title": "CVE ID", "type": "string", "description": "For EPSS mode: optional CVE ID (e.g. CVE-2025-12345). Leave blank to enumerate all scored CVEs." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```