# CISA KEV Inventory Match & Change Monitor (`snapperwapper/cisa-kev-inventory-match`) Actor

Match software inventory to the official CISA Known Exploited Vulnerabilities catalog and monitor catalog deltas.

- **URL**: https://apify.com/snapperwapper/cisa-kev-inventory-match.md
- **Developed by:** [snapperwapper](https://apify.com/snapperwapper) (community)
- **Categories:** Automation, Business
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per usage

This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## CISA KEV Inventory Match & Change Monitor

Read the official CISA Known Exploited Vulnerabilities (KEV) JSON feed, return normalized catalog records, monitor catalog changes, or compare KEV entries with a supplied software inventory. The Actor uses the fixed CISA JSON endpoint—no browser, scraping, arbitrary URLs, login, or proxy.

### Modes

- **`full`** — returns normalized current KEV entries with catalog provenance.
- **`delta`** — compares the current feed with `KEV_BASELINE`, emits `ADDED`, `UPDATED`, and `REMOVED` records, then saves the complete current baseline. A first run creates state and emits no catalog-wide false alert.
- **`inventory-match`** — matches inventory by exact CVE, exact normalized vendor+product, or optional conservative fuzzy vendor+product similarity.

```json
{
  "mode": "inventory-match",
  "inventory": [
    { "assetId": "edge-fw-01", "cveIds": ["CVE-2026-20349"] },
    { "assetId": "analytics-01", "vendor": "Metabase", "product": "Metabase", "version": "1.2.3" }
  ],
  "fuzzyMatching": false,
  "fuzzyThreshold": 0.88,
  "maxResults": 1000,
  "requestTimeoutSecs": 30,
  "maxRequestRetries": 3
}
```

Inventory items require a stable `assetId`. Exact CVE matches take precedence. Vendor/product matching requires **both** terms; fuzzy matching is off by default, enforces separate vendor and product similarity floors, rejects very short product descriptions, and reports `confidence` plus `matchedTerms`. An inventory match means only that supplied identifiers or names correspond to a KEV catalog entry. It does **not** establish that a particular installed version is affected or exploitable.

### Output and provenance

Rows use `recordType` values `KEV`, `KEV_CHANGE`, or `INVENTORY_MATCH`. CISA-provided fields—including `dateAdded`, `dueDate`, `requiredAction`, and `knownRansomwareCampaignUse`—are preserved without adding CVSS values, affected-version claims, or exploitability scores. Every record includes source authority, catalog name, fixed feed URL, catalog version, and release timestamp. Delta updates include deterministic `before`, `after`, and `changedFields` evidence.

`maxResults` caps output rows, not persisted delta state. Requests use bounded timeout and exponential retries only for timeouts, network errors, HTTP 408/429, and 5xx responses. Permanent errors are surfaced directly and also emitted as disclaimer-bearing `ERROR` rows. Every data, match, change, and error row carries a factual/legal disclaimer. A `REMOVED` delta is only an observation that an entry is no longer present in the current catalog; it does not mean fixed, remediated, not vulnerable, or deleted elsewhere.

### Safe demo and local test

With no Actor input, `src/main.js` defaults to bundled `demoMode`, which reads a three-entry fixture sanitized from the public CISA feed and performs **no network request**. Run:

```bash
npm ci
npm test
npm start
```

### Security, privacy, and legal notice

- Do not place secrets, credentials, personal data, or unnecessary internal details in `assetId`, vendor, product, or version fields. Actor inputs, datasets, and state may be retained according to your Apify storage settings.
- This is defensive prioritization support, not a vulnerability scanner, penetration-testing tool, guarantee of compromise, or substitute for vendor advisories and validated asset/version analysis.
- CISA's KEV fields are represented as source assertions; no claim is made beyond what the catalog states.
- Catalog absence is not a remediation, exploitability, affected-version, or legal conclusion.
- Use, retain, and redistribute public-source and inventory-derived data only as permitted by applicable law, organizational policy, source terms, and CISA usage guidance. The Actor is independent and is not endorsed by CISA.

# Actor input Schema

## `mode` (type: `string`):

full returns current KEV entries; delta compares with saved state; inventory-match compares supplied assets.

## `inventory` (type: `array`):

Assets to compare in inventory-match mode. Exact CVEs take precedence; vendor/product matching requires both terms.

## `fuzzyMatching` (type: `boolean`):

Opt in to conservative vendor/product token similarity. Every fuzzy result includes a confidence and matched terms.

## `fuzzyThreshold` (type: `number`):

Minimum weighted vendor/product confidence. A hard floor of 0.80 is enforced.

## `maxResults` (type: `integer`):

Global cap on catalog, change, or match rows. Delta state always stores the full current catalog.

## `demoMode` (type: `boolean`):

Use the bundled sanitized CISA-format fixture without any network request.

## `requestTimeoutSecs` (type: `number`):

Timeout per official API request in seconds.

## `maxRequestRetries` (type: `integer`):

Retries for timeouts, network failures, HTTP 408/429, and 5xx responses.

## Actor input object example

```json
{
  "mode": "full",
  "inventory": [],
  "fuzzyMatching": false,
  "fuzzyThreshold": 0.88,
  "maxResults": 1000,
  "demoMode": false,
  "requestTimeoutSecs": 30,
  "maxRequestRetries": 3
}
```

# Actor output Schema

## `dataset` (type: `string`):

Normalized KEV records and inventory-match results.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("snapperwapper/cisa-kev-inventory-match").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("snapperwapper/cisa-kev-inventory-match").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call snapperwapper/cisa-kev-inventory-match --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,snapperwapper/cisa-kev-inventory-match"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/cDWkDou4GbUqoeZUW/builds/JQ9DdGG6ZDhbUUii3/openapi.json