# CISA KEV Record Change Monitor (`quietdatatools/cisa-kev-record-change-monitor`) Actor

Track exact before/after changes to one CISA Known Exploited Vulnerabilities CVE record, including required action, due date, ransomware use, notes, and CWEs.

- **URL**: https://apify.com/quietdatatools/cisa-kev-record-change-monitor.md
- **Developed by:** [QuietDataTools](https://apify.com/quietdatatools) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$10.00 / 1,000 successful cve checks

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## CISA KEV Record Change Monitor

Monitor one exact CVE in the U.S. Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog. Repeated checks return a baseline, unchanged result, or exact before/after changes to vendor, product, vulnerability name, dates, description, required action, ransomware-campaign use, notes, and CWEs.

Built for vulnerability-management and SOC teams that already have a CVE watchlist and need durable per-record change history. It does not scan systems, determine exposure, rank risk, or remediate anything. CISA's catalog is public and CC0; use the official feed directly if you do not need this monitoring workflow. QuietDataTools is not affiliated with CISA. Demand and profitability are not established.

### Input

```json
{"cveId":"CVE-2021-44228","monitorName":"default","includeUnchanged":true}
```

Keep monitorName stable to continue history. A new name starts a baseline. Save the input as an Apify Task and attach a Schedule for recurring checks; this Actor does not create schedules.

### Output

Every successful check emits a dataset row by default with changeStatus BASELINE, CHANGED, or UNCHANGED and exact previous/current values. Change types include VENDOR_CHANGED, PRODUCT_CHANGED, NAME_CHANGED, DATE_ADDED_CHANGED, DESCRIPTION_CHANGED, REQUIRED_ACTION_CHANGED, DUE_DATE_CHANGED, RANSOMWARE_USE_CHANGED, NOTES_CHANGED, CWE_ADDED, and CWE_REMOVED. Warnings can include KNOWN_RANSOMWARE_CAMPAIGN_USE and REMEDIATION_DUE_DATE_PASSED.

Set includeUnchanged false to suppress unchanged dataset rows. OUTPUT is still written and the successful check is still charged. Missing target CVEs fail rather than being interpreted as removal. Incomplete, duplicate, or unsupported source records fail closed.

### History and failures

History is isolated by user, Actor, CVE ID, and monitor name. Source and delivery failures retain the last committed snapshot. Dataset and OUTPUT delivery happen before charging; history commits only after a successful charge. A five-minute best-effort lease rejects overlapping checks, but storage is not an atomic lock. Run the same monitor sequentially. If a process stops after charging but before commit, a retry may repeat output and charges. Platform retention or deleting history starts a new baseline.

### Pricing and limits

$0.01 per successful CVE check, including baseline and unchanged checks. Platform usage is included; no start or per-row charge. Failed checks are not charged. Set maximum run charge to at least $0.01. Defaults: 256 MB, 60 seconds, $0.05 maximum charge, restart off, standby off. One exact CVE per run; fixed official JSON feed only; response at most 5 MB; 20-second deadline; at most three same-origin redirects and 10,000 catalog records. No accounts, tokens, proxies, arbitrary URLs, or paid services.

Official feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Catalog information: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Official public mirror and transparent history: https://github.com/cisagov/kev-data

Treat output as source metadata, not security advice. A KEV entry shows evidence of active exploitation but does not determine exposure in your environment. Review CISA guidance and your own asset inventory. Historical corrections can appear as changes.

### Support and implementation

Use Issues with the CVE ID, monitor name, and run ID. No credentials. Node.js 22, Apify SDK 3.7.2, pinned lockfile, native HTTPS, no cookies or response cache. Production audit and cloud build reported zero known vulnerabilities on October 8, 2026. Forty built-in tests cover normalization, tracked changes, corrupt/incomplete data, delivery ordering, failed-source history preservation, and network bounds. Owner release checks are not customer usage.

# Actor input Schema

## `cveId` (type: `string`):

One exact CVE already present in CISA KEV, for example CVE-2021-44228.

## `monitorName` (type: `string`):

Keep stable for comparison history; change it to start a new baseline.

## `includeUnchanged` (type: `boolean`):

Disable to keep successful unchanged checks out of the dataset. OUTPUT is still written and the check is still charged.

## Actor input object example

```json
{
  "cveId": "CVE-2021-44228",
  "monitorName": "default",
  "includeUnchanged": true
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "cveId": "CVE-2021-44228"
};

// Run the Actor and wait for it to finish
const run = await client.actor("quietdatatools/cisa-kev-record-change-monitor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "cveId": "CVE-2021-44228" }

# Run the Actor and wait for it to finish
run = client.actor("quietdatatools/cisa-kev-record-change-monitor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "cveId": "CVE-2021-44228"
}' |
apify call quietdatatools/cisa-kev-record-change-monitor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,quietdatatools/cisa-kev-record-change-monitor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/MZ54oYuBlPf253KVk/builds/Zm5VYiLnxy9HKjeRt/openapi.json