CISA ICS Advisory Change Monitor - New & Updated Only

Monitor official CISA ICS/OT security advisories and emit only the new, updated, or removed advisory rows that matter across scheduled runs. The Actor reads CISA's public machine-readable CSAF repository for Operational Technology advisories, normalizes the fields security teams usually need, stores a baseline in an Apify key-value store, and pushes one Dataset row only when a matching advisory changes.

This Actor is intentionally narrow. It does not scan your network, exploit systems, enrich private assets, or decide whether a vulnerability applies to your environment. It turns public CISA ICS advisory records into clean change rows for OT security, vulnerability management, compliance evidence, alerting, ticket routing, and dashboard automation.

Legal basis: the upstream source is CISA's official public CSAF security advisory data on GitHub and linked CISA advisory pages. The data is public government cybersecurity information, but downstream use still belongs to you. Users remain responsible for validating affected assets, remediation priority, regulatory obligations, retention rules, and any security operations decisions made from the output.

What it does

• Reads CISA CSAF OT/ICS advisory JSON from cisagov/CSAF.
• Filters by advisory year, advisory ID, vendor text, product text, and parsed severity.
• Extracts advisory title, status, version, release dates, CISA web URL, raw JSON URL, vendors, products, CVEs, CWEs, highest parsed CVSS score, severity, summary, and remediation-oriented text when present.
• Stores a state baseline by stateStoreName.
• Emits new, updated, or removed rows only when the selected advisory set changes.
• Charges one pay-per-event unit per emitted advisory change, not per scanned advisory.
• Works without cookies, proxies, user accounts, or private data.

Quick start

The default input monitors the current-year CISA ICS advisory set and saves a baseline without charging for already existing records:

{
  "years": [2026],
  "vendors": [],
  "products": [],
  "severities": [],
  "advisoryIds": [],
  "firstRun": "baselineOnly",
  "stateStoreName": "cisa-ics-advisory-delta-state",
  "includeRemoved": true,
  "resetState": false,
  "maxAdvisories": 500,
  "timeoutSeconds": 45
}

For a first test that produces rows immediately, set firstRun to emitCurrent and optionally use a small maxAdvisories value.

Use cases

• Alert OT security teams when CISA publishes or updates ICS advisories.
• Feed a vulnerability management queue with vendor, product, CVE, CWE, CVSS, source URL, and detected timestamp fields.
• Track only vendors relevant to your environment, such as Siemens, Schneider, Rockwell, Mitsubishi, ABB, or GE.
• Preserve a change log for compliance evidence without manually revisiting CISA pages.
• Send advisory changes to Slack, email, SIEM, Google Sheets, Make, Zapier, n8n, or an internal ticketing workflow through Apify integrations.
• Compare current CISA OT advisory coverage with your asset inventory outside the Actor.

Input

years selects one to five CSAF OT advisory years. Use the current year for routine monitoring, or include a prior year when you need to track revisions to older advisories.

vendors and products are case-insensitive text filters matched against normalized product names, inferred vendor names, and advisory titles. Leave them empty to monitor all CISA ICS advisories for the selected years.

severities filters by the highest parsed CVSS v3 base score: critical, high, medium, low, or unknown.

advisoryIds lets you monitor specific IDs such as ICSA-26-139-03.

firstRun controls whether the first run only saves a baseline or emits the current matching advisories as new.

stateStoreName must be unique for each independent watchlist. Do not reuse the same state store for different filters unless you intentionally set resetState once.

maxAdvisories bounds source retrieval and spending exposure.

Example output

{
  "changeType": "new",
  "lifecycleId": "ICSA-26-139-03",
  "advisoryId": "ICSA-26-139-03",
  "title": "ScadaBR",
  "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-03",
  "jsonUrl": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-139-03.json",
  "status": "final",
  "version": "1",
  "currentReleaseDate": "2026-05-19T06:00:00.000000Z",
  "initialReleaseDate": "2026-05-19T06:00:00.000000Z",
  "vendors": ["ScadaBR"],
  "products": ["ScadaBR"],
  "cves": ["CVE-2026-0001"],
  "cwes": ["CWE-79"],
  "maxCvssBaseScore": 8.8,
  "severity": "high",
  "summary": "A vulnerability affects the product.",
  "remediationSummary": "Apply the vendor update.",
  "rawPath": "csaf_files/OT/white/2026/icsa-26-139-03.json",
  "previousVersion": null,
  "detectedAt": "2026-07-17T00:00:00.000Z"
}

Pricing

This Actor uses pay per event pricing. The primary event is advisory change. One emitted Dataset row equals one charged advisory-change event. Baseline-only runs can scan the selected public source set without emitting historical rows.

Example: 1,000 emitted advisory changes cost $1.00 at $0.001 per advisory change before any Apify platform minimums or account-level limits.

API example

curl "https://api.apify.com/v2/acts/rtworule~cisa-ics-advisory-delta-monitor/runs?token=$APIFY_TOKEN" \
  -H "content-type: application/json" \
  -d '{
    "years": [2026],
    "vendors": ["Siemens", "Schneider"],
    "severities": ["critical", "high"],
    "firstRun": "baselineOnly",
    "stateStoreName": "cisa-ics-high-vendor-watch"
  }'

Integrations

• Apify Scheduler for hourly or daily advisory checks.
• Webhooks for notifying a SOC queue after a run emits new rows.
• Google Sheets, Make, Zapier, and n8n through Apify integrations.
• SIEM, ticketing, data warehouse, or vulnerability management workflows through the Apify Dataset API.
• Portfolio pairing: use Bulk Website Tech Stack Detector to map public technology signals, Bulk URL Health Auditor to verify source links, and GLEIF LEI Batch Validator for public legal-entity reference checks.

Limitations

• CISA advisory data is a vulnerability intelligence input, not proof that your environment is affected.
• Vendor names are inferred from CSAF product names and may need your own asset mapping.
• The Actor does not run exploit checks, authenticated scans, SBOM matching, EPSS enrichment, or KEV correlation.
• Removed rows usually mean the advisory no longer appears in the selected source/filter set. Confirm manually before treating a removal as a CISA retraction.
• CISA GitHub availability, CSAF schema stability, and GitHub unauthenticated rate limits are upstream dependencies.

FAQ

Is this an official CISA product?

No. It is an Apify Actor that uses CISA's official public CSAF advisory data and links each row back to CISA's source page and raw JSON.

Why does the first run emit nothing by default?

Most teams want alerts only for changes after they create a monitor. baselineOnly saves the current state and avoids flooding downstream workflows with old advisories.

Can this tell me whether I am vulnerable?

No. It reports public advisory changes. You still need an asset inventory, product/version matching, compensating-control review, and remediation process.

Can I monitor only one vendor?

Yes. Add vendor text to vendors, use a unique stateStoreName, and schedule recurring runs.

Responsible use

Use this Actor for public CISA ICS/OT advisory monitoring, vulnerability management triage, compliance evidence, and workflow automation. Do not treat the output as a substitute for incident response, asset discovery, exploit validation, legal advice, or regulatory compliance approval. Keep private network details, credentials, incident reports, and regulated customer data out of support messages and logs.

More tools

Related Actors in this portfolio:

• NWS Weather Alert Change Monitor emits official weather-alert lifecycle changes.
• GLEIF LEI Batch Validator checks public legal-entity reference data.
• Public RSS, Atom & JSON Feed Normalizer turns public feeds into consistent rows.
• Bulk URL Health Auditor checks public URL status and redirects.
• AI Search Readiness Auditor checks public website AI-crawler and metadata readiness.

Support

Open an issue or contact the Actor maintainer through the Apify Store listing with the run ID, input, advisory ID, and expected behavior. Do not send secrets, private asset inventories, exploit details, or regulated data in support messages.