CISA KEV Portfolio Change Monitor

Check a defined CVE, vendor, or product portfolio against the official CISA Known Exploited Vulnerabilities (KEV) catalog. The Actor is designed for recurring portfolio review: it preserves CISA's wording, due date, required action, ransomware-use field, notes, and CWE identifiers, then delivers only new or changed matches when requested.

Input and recurring checks

Use cveIds for exact identifiers. vendors and products are literal, case-insensitive phrases; they do not infer product identity. snapshot mode returns current matches. For changes mode, provide a separate stateStoreId for each portfolio and run that task sequentially. The first snapshot establishes a useful baseline; later changes runs deliver additions or changed CISA fields.

{"cveIds":["CVE-2021-44228","CVE-2023-34362"],"vendors":[],"products":[],"maxRecords":50,"mode":"snapshot"}

One paid result is one matching KEV entry written to the default dataset. The run-start event is $0.01 and each delivered record is $0.001. Platform usage is included. Filtered-out and unchanged entries are not record events.

Interpretation and limits

The source is the CISA-maintained KEV data repository, read from its published JSON mirror. This Actor is a read-only catalog monitor. It does not scan systems, test exploits, inventory installed versions, or prove exposure. No matching catalog entry means only that no matching entry was found in the retrieved KEV catalog; it does not establish that a product is secure or vulnerability-free. Verify remediation decisions against CISA and the relevant vendor advisory.

Source attribution: Cybersecurity and Infrastructure Security Agency, Known Exploited Vulnerabilities Catalog. The repository is published under CC0-1.0.