FIRST.org CSIRT Teams + EPSS Scraper

FIRST.org CSIRT Teams + EPSS Scraper

Scrape the FIRST.org CSIRT teams directory and EPSS exploit-likelihood scores for any CVE, up to a million rows per run. Every team comes with its name, host, country, and contact details. Every EPSS row includes the score and percentile. Export to CSV, JSON, Excel, or XML.

FIRST.org publishes the global directory of CSIRT and SOC teams, plus the EPSS service that scores how likely a CVE is to be exploited. This Actor reads both public feeds directly, so you can build a list of incident response contacts or enrich your vulnerability data without manual lookups. Filter teams by country or name, or pull EPSS scores for one CVE or the entire scored set.

Who uses it	What they scrape FIRST.org for
Security operations analysts	Build a current list of CSIRT contacts for incident reporting and coordination.
Vulnerability management teams	Prioritize patching by pulling EPSS scores for the CVEs in their environment.
Threat intelligence researchers	Map the global CSIRT landscape by country or team name for regional studies.
Compliance officers	Verify which CSIRT teams exist in a given country for regulatory reporting.

What it does

This Actor collects CSIRT team records from the FIRST.org directory or EPSS exploit prediction scores for CVEs, and returns each one as a flat row.

• 🌍 Teams directory: collect CSIRT and SOC teams with name, host, country, and contact details.
• 📈 EPSS scores: get exploit prediction scores and percentiles for one CVE or all scored CVEs.
• 🔍 Country filter: restrict teams to a single ISO-2 country code, or leave blank for all.
• 📝 Name filter: return only teams whose name or host contains a given substring.
• ⚙️ Flexible limits: set a maximum number of records per run, from 1 to 1,000,000.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with FIRST.org data

🚨 Build an incident response contact list.

A SOC analyst runs the Actor in teams mode with no country filter to get every CSIRT team, then imports the CSV into their ticketing system for faster breach notifications.

🎯 Prioritize vulnerabilities with EPSS.

A vulnerability manager runs the Actor in EPSS mode for a list of CVEs and uses the scores to decide which patches to deploy this week.

🗺️ Map CSIRT coverage by country.

A threat researcher runs the Actor with a country filter for each ISO-2 code and builds a heatmap of incident response capacity across regions.

🔎 Find a specific team by name.

A compliance officer uses the team name filter to locate the official CSIRT for a partner organization and confirm its contact details.

Why choose this scraper

	What you get
No API key	Reads the public FIRST.org feeds directly, no registration or authentication.
Two data sources	One Actor covers both the CSIRT directory and EPSS scoring service.
Clean flat output	Every record is a single row, ready for CSV, JSON, Excel, or XML export.
Up to a million rows	Set maxItems high enough to pull the entire directory or EPSS dataset.

How it compares

No other Store actor targets FIRST.org the same way, so the honest comparison is with the alternatives teams actually weigh.

	FIRST.org CSIRT Teams + EPSS Scraper	Build it in-house	By hand
Setup	Run it now, zero config	Days of engineering	None, but hours per pull
When FIRST.org changes	Maintained for you	You fix it	You re-learn the page
Proxies, retries, anti-bot	Built in	Your problem	Browser only
Output	Fixed JSON schema, CSV/Excel export	Whatever you build	Copy-paste
Cost	Pay per result	Engineering time	Analyst hours

Configure the run

Drive the Actor with a mode switch between teams and EPSS, then narrow results by country, team name substring, or a specific CVE ID. The Input tab lists every parameter.

A first run with the defaults:

{
 "maxItems": 10,
 "mode": "teams"
}

A larger pull:

{
 "maxItems": 200,
 "mode": "teams"
}

Pricing

Pay-per-result: $0.01867 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$1.87
1,000 results	$18.67
10,000 results	$186.70

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the FIRST.org CSIRT Teams + EPSS Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to FIRST.org through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

$claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/first-org-csirt-teams-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check your filters. If you set a country or team name filter, it may exclude all records. Try clearing the filters and running again. Also ensure the mode is set correctly for the data you want.

Why does the run stop before reaching my maxItems?

The Actor stops when it has collected all available records from the source. If the FIRST.org directory or EPSS dataset has fewer records than your maxItems, the run will end early.

Why is my CVE query returning an error?

Make sure the CVE ID is in the correct format, such as CVE-2025-12345. If the CVE is not in the EPSS dataset, no score will be returned.

Can I get contact details for every team?

The FIRST.org directory includes contact information for most teams, but some teams may not publish full details. The Actor returns whatever is publicly available.

FAQ

Question	Answer
What is the difference between teams mode and EPSS mode?	Teams mode returns records from the FIRST.org CSIRT directory, including team name, host, country, and contact information. EPSS mode returns exploit prediction scores and percentiles for CVEs from the FIRST.org EPSS service.
Do I need an API key or account?	No. The Actor reads the public FIRST.org feeds directly, so no registration or authentication is required.
Can I get EPSS scores for a single CVE?	Yes. In EPSS mode, enter a CVE ID like CVE-2025-12345 in the CVE ID field. Leave it blank to enumerate all scored CVEs.
How do I filter teams by country?	Use the Country (ISO-2) dropdown to select a two-letter country code, such as US or DE. Leave it blank to include all countries.
What does the team name filter do?	It returns only teams whose name or host contains the substring you enter, case-insensitive. For example, entering 'gov' would match teams with 'gov' in their name or host.
How many records can I collect in one run?	You can set the maximum number of teams or EPSS rows from 1 to 1,000,000 per run.
What output formats are supported?	The Actor returns data in a flat structure that can be exported to CSV, JSON, Excel, or XML from the Apify platform.
Is the data live?	Yes, the Actor fetches the current public feeds from FIRST.org at the time of the run.
Can I schedule this Actor to run regularly?	Yes, you can set up a schedule in Apify to run it daily, weekly, or at any interval you need.
What is EPSS?	EPSS stands for Exploit Prediction Scoring System. It estimates the probability that a software vulnerability will be exploited in the wild within the next 30 days.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by FIRST.Org, Inc. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.