# CISA ICS Advisory Change Monitor - New & Updated Only (`rtworule/cisa-ics-advisory-delta-monitor`) Actor Monitor official CISA ICS advisories and emit only new, updated, or removed CSAF records for OT security, vulnerability management, and compliance workflows. - **URL**: https://apify.com/rtworule/cisa-ics-advisory-delta-monitor.md - **Developed by:** [Kunteper Koyu](https://apify.com/rtworule) (community) - **Categories:** Developer tools, Automation, Business - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing $1.00 / 1,000 advisory changes This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## CISA ICS Advisory Change Monitor - New & Updated Only Monitor official CISA ICS/OT security advisories and emit only the new, updated, or removed advisory rows that matter across scheduled runs. The Actor reads CISA's public machine-readable CSAF repository for Operational Technology advisories, normalizes the fields security teams usually need, stores a baseline in an Apify key-value store, and pushes one Dataset row only when a matching advisory changes. This Actor is intentionally narrow. It does not scan your network, exploit systems, enrich private assets, or decide whether a vulnerability applies to your environment. It turns public CISA ICS advisory records into clean change rows for OT security, vulnerability management, compliance evidence, alerting, ticket routing, and dashboard automation. Legal basis: the upstream source is CISA's official public CSAF security advisory data on GitHub and linked CISA advisory pages. The data is public government cybersecurity information, but downstream use still belongs to you. Users remain responsible for validating affected assets, remediation priority, regulatory obligations, retention rules, and any security operations decisions made from the output. ### What it does - Reads CISA CSAF OT/ICS advisory JSON from `cisagov/CSAF`. - Filters by advisory year, advisory ID, vendor text, product text, and parsed severity. - Extracts advisory title, status, version, release dates, CISA web URL, raw JSON URL, vendors, products, CVEs, CWEs, highest parsed CVSS score, severity, summary, and remediation-oriented text when present. - Stores a state baseline by `stateStoreName`. - Emits `new`, `updated`, or `removed` rows only when the selected advisory set changes. - Charges one pay-per-event unit per emitted advisory change, not per scanned advisory. - Works without cookies, proxies, user accounts, or private data. ### Quick start The default input monitors the current-year CISA ICS advisory set and saves a baseline without charging for already existing records: ```json { "years": [2026], "vendors": [], "products": [], "severities": [], "advisoryIds": [], "firstRun": "baselineOnly", "stateStoreName": "cisa-ics-advisory-delta-state", "includeRemoved": true, "resetState": false, "maxAdvisories": 500, "timeoutSeconds": 45 } ```` For a first test that produces rows immediately, set `firstRun` to `emitCurrent` and optionally use a small `maxAdvisories` value. ### Use cases - Alert OT security teams when CISA publishes or updates ICS advisories. - Feed a vulnerability management queue with vendor, product, CVE, CWE, CVSS, source URL, and detected timestamp fields. - Track only vendors relevant to your environment, such as Siemens, Schneider, Rockwell, Mitsubishi, ABB, or GE. - Preserve a change log for compliance evidence without manually revisiting CISA pages. - Send advisory changes to Slack, email, SIEM, Google Sheets, Make, Zapier, n8n, or an internal ticketing workflow through Apify integrations. - Compare current CISA OT advisory coverage with your asset inventory outside the Actor. ### Input `years` selects one to five CSAF OT advisory years. Use the current year for routine monitoring, or include a prior year when you need to track revisions to older advisories. `vendors` and `products` are case-insensitive text filters matched against normalized product names, inferred vendor names, and advisory titles. Leave them empty to monitor all CISA ICS advisories for the selected years. `severities` filters by the highest parsed CVSS v3 base score: `critical`, `high`, `medium`, `low`, or `unknown`. `advisoryIds` lets you monitor specific IDs such as `ICSA-26-139-03`. `firstRun` controls whether the first run only saves a baseline or emits the current matching advisories as `new`. `stateStoreName` must be unique for each independent watchlist. Do not reuse the same state store for different filters unless you intentionally set `resetState` once. `maxAdvisories` bounds source retrieval and spending exposure. ### Example output ```json { "changeType": "new", "lifecycleId": "ICSA-26-139-03", "advisoryId": "ICSA-26-139-03", "title": "ScadaBR", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-03", "jsonUrl": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-139-03.json", "status": "final", "version": "1", "currentReleaseDate": "2026-05-19T06:00:00.000000Z", "initialReleaseDate": "2026-05-19T06:00:00.000000Z", "vendors": ["ScadaBR"], "products": ["ScadaBR"], "cves": ["CVE-2026-0001"], "cwes": ["CWE-79"], "maxCvssBaseScore": 8.8, "severity": "high", "summary": "A vulnerability affects the product.", "remediationSummary": "Apply the vendor update.", "rawPath": "csaf_files/OT/white/2026/icsa-26-139-03.json", "previousVersion": null, "detectedAt": "2026-07-17T00:00:00.000Z" } ``` ### Pricing This Actor uses pay per event pricing. The primary event is **advisory change**. One emitted Dataset row equals one charged advisory-change event. Baseline-only runs can scan the selected public source set without emitting historical rows. Example: 1,000 emitted advisory changes cost $1.00 at `$0.001` per advisory change before any Apify platform minimums or account-level limits. ### API example ```bash curl "https://api.apify.com/v2/acts/rtworule~cisa-ics-advisory-delta-monitor/runs?token=$APIFY_TOKEN" \ -H "content-type: application/json" \ -d '{ "years": [2026], "vendors": ["Siemens", "Schneider"], "severities": ["critical", "high"], "firstRun": "baselineOnly", "stateStoreName": "cisa-ics-high-vendor-watch" }' ``` ### Integrations - Apify Scheduler for hourly or daily advisory checks. - Webhooks for notifying a SOC queue after a run emits new rows. - Google Sheets, Make, Zapier, and n8n through Apify integrations. - SIEM, ticketing, data warehouse, or vulnerability management workflows through the Apify Dataset API. - Portfolio pairing: use Bulk Website Tech Stack Detector to map public technology signals, Bulk URL Health Auditor to verify source links, and GLEIF LEI Batch Validator for public legal-entity reference checks. ### Limitations - CISA advisory data is a vulnerability intelligence input, not proof that your environment is affected. - Vendor names are inferred from CSAF product names and may need your own asset mapping. - The Actor does not run exploit checks, authenticated scans, SBOM matching, EPSS enrichment, or KEV correlation. - Removed rows usually mean the advisory no longer appears in the selected source/filter set. Confirm manually before treating a removal as a CISA retraction. - CISA GitHub availability, CSAF schema stability, and GitHub unauthenticated rate limits are upstream dependencies. ### FAQ #### Is this an official CISA product? No. It is an Apify Actor that uses CISA's official public CSAF advisory data and links each row back to CISA's source page and raw JSON. #### Why does the first run emit nothing by default? Most teams want alerts only for changes after they create a monitor. `baselineOnly` saves the current state and avoids flooding downstream workflows with old advisories. #### Can this tell me whether I am vulnerable? No. It reports public advisory changes. You still need an asset inventory, product/version matching, compensating-control review, and remediation process. #### Can I monitor only one vendor? Yes. Add vendor text to `vendors`, use a unique `stateStoreName`, and schedule recurring runs. ### Responsible use Use this Actor for public CISA ICS/OT advisory monitoring, vulnerability management triage, compliance evidence, and workflow automation. Do not treat the output as a substitute for incident response, asset discovery, exploit validation, legal advice, or regulatory compliance approval. Keep private network details, credentials, incident reports, and regulated customer data out of support messages and logs. ### More tools Related Actors in this portfolio: - NWS Weather Alert Change Monitor emits official weather-alert lifecycle changes. - GLEIF LEI Batch Validator checks public legal-entity reference data. - Public RSS, Atom & JSON Feed Normalizer turns public feeds into consistent rows. - Bulk URL Health Auditor checks public URL status and redirects. - AI Search Readiness Auditor checks public website AI-crawler and metadata readiness. ### Support Open an issue or contact the Actor maintainer through the Apify Store listing with the run ID, input, advisory ID, and expected behavior. Do not send secrets, private asset inventories, exploit details, or regulated data in support messages. # Actor input Schema ## `years` (type: `array`): CISA CSAF OT advisory years to monitor. The default checks the current year and succeeds without credentials. ## `vendors` (type: `array`): Optional case-insensitive vendor text filters such as Siemens, Schneider, or Rockwell. Empty means all vendors. ## `products` (type: `array`): Optional case-insensitive product text filters. Empty means all products. ## `severities` (type: `array`): Keep only advisories whose highest parsed CVSS score maps to one of these severities. Empty means all severities. ## `advisoryIds` (type: `array`): Optional CISA ICS advisory IDs such as ICSA-26-139-03. Empty means all matching advisories for the selected years. ## `firstRun` (type: `string`): Baseline avoids notifying about advisories that already existed when a monitor was created. ## `stateStoreName` (type: `string`): Use a unique name for each independent watchlist or scheduled task. ## `includeRemoved` (type: `boolean`): Emit a removed record when a previously tracked advisory disappears from the selected CSAF source set. ## `resetState` (type: `boolean`): Clear the previous baseline once. Turn this off after the reset run. ## `maxAdvisories` (type: `integer`): Hard cap across selected years and filters. ## `timeoutSeconds` (type: `integer`): Maximum seconds for each CISA CSAF source request. ## Actor input object example ```json { "years": [ 2026 ], "vendors": [], "products": [], "severities": [], "advisoryIds": [], "firstRun": "baselineOnly", "stateStoreName": "cisa-ics-advisory-delta-state", "includeRemoved": true, "resetState": false, "maxAdvisories": 500, "timeoutSeconds": 45 } ``` # Actor output Schema ## `dataset` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = {}; // Run the Actor and wait for it to finish const run = await client.actor("rtworule/cisa-ics-advisory-delta-monitor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = {} # Run the Actor and wait for it to finish run = client.actor("rtworule/cisa-ics-advisory-delta-monitor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{}' | apify call rtworule/cisa-ics-advisory-delta-monitor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=rtworule/cisa-ics-advisory-delta-monitor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "CISA ICS Advisory Change Monitor - New & Updated Only", "description": "Monitor official CISA ICS advisories and emit only new, updated, or removed CSAF records for OT security, vulnerability management, and compliance workflows.", "version": "0.1", "x-build-id": "4Szyu2mcshJYkn2t0" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/rtworule~cisa-ics-advisory-delta-monitor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-rtworule-cisa-ics-advisory-delta-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/rtworule~cisa-ics-advisory-delta-monitor/runs": { "post": { "operationId": "runs-sync-rtworule-cisa-ics-advisory-delta-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/rtworule~cisa-ics-advisory-delta-monitor/run-sync": { "post": { "operationId": "run-sync-rtworule-cisa-ics-advisory-delta-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "years": { "title": "Advisory years", "type": "array", "description": "CISA CSAF OT advisory years to monitor. The default checks the current year and succeeds without credentials.", "items": { "type": "integer", "minimum": 2024, "maximum": 2027 }, "default": [ 2026 ] }, "vendors": { "title": "Vendor filters", "type": "array", "description": "Optional case-insensitive vendor text filters such as Siemens, Schneider, or Rockwell. Empty means all vendors.", "default": [], "items": { "type": "string" } }, "products": { "title": "Product filters", "type": "array", "description": "Optional case-insensitive product text filters. Empty means all products.", "default": [], "items": { "type": "string" } }, "severities": { "title": "Severity filters", "uniqueItems": true, "type": "array", "description": "Keep only advisories whose highest parsed CVSS score maps to one of these severities. Empty means all severities.", "items": { "type": "string", "enum": [ "critical", "high", "medium", "low", "unknown" ] }, "default": [] }, "advisoryIds": { "title": "Specific advisory IDs", "type": "array", "description": "Optional CISA ICS advisory IDs such as ICSA-26-139-03. Empty means all matching advisories for the selected years.", "default": [], "items": { "type": "string" } }, "firstRun": { "title": "First run behavior", "enum": [ "baselineOnly", "emitCurrent" ], "type": "string", "description": "Baseline avoids notifying about advisories that already existed when a monitor was created.", "default": "baselineOnly" }, "stateStoreName": { "title": "Persistent state store", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9-_]*$", "minLength": 3, "maxLength": 63, "type": "string", "description": "Use a unique name for each independent watchlist or scheduled task.", "default": "cisa-ics-advisory-delta-state" }, "includeRemoved": { "title": "Emit removed transitions", "type": "boolean", "description": "Emit a removed record when a previously tracked advisory disappears from the selected CSAF source set.", "default": true }, "resetState": { "title": "Reset saved state", "type": "boolean", "description": "Clear the previous baseline once. Turn this off after the reset run.", "default": false }, "maxAdvisories": { "title": "Maximum advisories", "minimum": 1, "maximum": 5000, "type": "integer", "description": "Hard cap across selected years and filters.", "default": 500 }, "timeoutSeconds": { "title": "Request timeout", "minimum": 2, "maximum": 120, "type": "integer", "description": "Maximum seconds for each CISA CSAF source request.", "default": 45 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```