# 🛡️ CISA KEV Deadline & EPSS Vulnerability Radar (`snuggly_beanie_970/cisa-kev-remediation-radar`) Actor

🛡️ Prioritize actively exploited vulnerabilities using CISA KEV deadlines plus FIRST EPSS probability. 🚨 Flag overdue fixes, ransomware use and high-risk CVEs. ✅ Schedule-ready, deduplicated security alerts with official sources.

- **URL**: https://apify.com/snuggly\_beanie\_970/cisa-kev-remediation-radar.md
- **Developed by:** [Ilia](https://apify.com/snuggly_beanie_970) (community)
- **Categories:** Developer tools, Automation, Business
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $3.00 / 1,000 prioritized kev findings

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## 🛡️ CISA KEV Remediation Deadline & EPSS Radar

Turn the official CISA Known Exploited Vulnerabilities catalog into a prioritized remediation queue. This Actor focuses on operational deadlines: it calculates overdue status and days remaining, then enriches each actively exploited CVE with FIRST EPSS probability and ransomware-use evidence.

It is designed for vulnerability-management teams, MSSPs, security operations, cyber insurers, compliance teams, and scheduled AI-agent workflows.

### How this differs from a generic KEV scraper

A catalog search tells you which vulnerabilities exist. This Actor tells you **what needs attention first**:

- rolling CISA remediation deadline window;
- overdue and due-today detection;
- `daysUntilDue` calculated on every run;
- FIRST EPSS exploit probability and percentile;
- known ransomware campaign filtering;
- deterministic `critical`, `high`, `medium`, or `low` priority;
- vendor, product, keyword, and catalog-added-date filters.

### Example input

```json
{
  "dueWithinDays": 30,
  "includeOverdue": true,
  "overdueWithinDays": 30,
  "addedWithinDays": 0,
  "vendors": ["Microsoft", "Cisco", "Fortinet"],
  "products": [],
  "keywords": [],
  "ransomwareOnly": false,
  "minimumEpss": 0.1,
  "maxItems": 100
}
```

The date window is relative to the day of each run, so the same input works on an Apify schedule without maintenance.

### Example output

```json
{
  "cveId": "CVE-2026-12345",
  "vendorProject": "Example Vendor",
  "product": "Example Product",
  "vulnerabilityName": "Example vulnerability",
  "dateAdded": "2026-08-20",
  "dueDate": "2026-09-10",
  "daysUntilDue": 10,
  "deadlineStatus": "upcoming",
  "knownRansomwareCampaignUse": true,
  "epssScore": 0.82,
  "epssPercentile": 0.99,
  "priority": "critical",
  "requiredAction": "Apply mitigations per vendor instructions.",
  "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-12345",
  "cisaCatalogUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
```

The example illustrates the schema and is not a real vulnerability record.

### Priority rules

| Priority | Rule |
| --- | --- |
| Critical | Overdue, known ransomware use, or EPSS ≥ 0.70 |
| High | Due within 7 days or EPSS ≥ 0.30 |
| Medium | Other matching KEV entries |
| Low | Due more than 30 days away and EPSS below 0.10 |

These labels are a consistent triage aid, not a replacement for asset exposure, business impact, or your organization's risk model.

### Automation recipe

Run daily and route the dataset to Slack, email, a ticketing system, SIEM, SOAR, Make, Zapier, webhook, or an MCP-compatible AI client. Use `cveId` as the stable deduplication key and alert again when `deadlineStatus` or `priority` changes.

### 💰 Pricing

Pay only for matching findings written to the dataset. Filters run before charging, `maxItems` caps paid results, and Apify's maximum-charge limit can cap total run cost. No proxy, CISA key, NVD key, or FIRST API key is required. See the Pricing tab for the current event rate.

### 🔎 Data sources

- CISA KEV JSON: official list of vulnerabilities known to be exploited in the wild, read from CISA's official `cisagov/kev-data` mirror with the CISA website feed as fallback.
- FIRST EPSS: probability estimate for exploitation activity in the next 30 days; a score may be unavailable for a very new CVE.
- CISA due dates are binding guidance for US Federal Civilian Executive Branch agencies under BOD 22-01, but other organizations use them as prioritization signals.
- Verify remediation instructions with CISA and the affected vendor. This Actor does not scan assets and does not prove that your systems are vulnerable.

### Support

Open an issue with the CVE ID and a description of the unexpected field. Do not include internal asset inventories, tokens, or credentials.

### 📥 Complete input reference

| Field | Type | Default | Purpose |
|---|---|---:|---|
| `dueWithinDays` | integer | `30` | Rolling remediation window starting today. Use 0 to return only items due today or overdue. |
| `includeOverdue` | boolean | `true` | Include KEV entries whose CISA remediation deadline has already passed. |
| `overdueWithinDays` | integer | `30` | Limit overdue findings to deadlines missed within this many days, preventing years-old KEVs from overwhelming the queue. |
| `addedWithinDays` | integer | `0` | Optionally include only vulnerabilities added to KEV within this many days. Zero disables this filter. |
| `vendors` | array | — | Optional case-insensitive vendor filters, for example Microsoft, Cisco, or Fortinet. |
| `products` | array | — | Optional case-insensitive product filters. |
| `keywords` | array | — | Match any keyword across CVE ID, vendor, product, name, description, and required action. |
| `ransomwareOnly` | boolean | `false` | Return only vulnerabilities CISA associates with known ransomware campaigns. |
| `minimumEpss` | number | `0` | Minimum FIRST EPSS score from 0 to 1. Zero keeps entries without an EPSS score. |
| `maxItems` | integer | `100` | Maximum matching rows written and charged. |

### 📤 Complete output reference

The default dataset is exportable as JSON, CSV, Excel, XML or RSS. Fields remain stable for scheduled runs and API integrations.

| Field | Type |
|---|---|
| `cveId` | string |
| `vendorProject` | string |
| `product` | string |
| `vulnerabilityName` | string |
| `dateAdded` | string |
| `dueDate` | string |
| `daysUntilDue` | integer |
| `deadlineStatus` | string |
| `knownRansomwareCampaignUse` | boolean |
| `epssScore` | number |
| `epssPercentile` | number |
| `priority` | string |
| `shortDescription` | string |
| `requiredAction` | string |
| `notes` | string |
| `cwes` | array |
| `nvdUrl` | string |
| `cisaCatalogUrl` | string |
| `sourceCatalogVersion` | string |
| `sourceCatalogReleased` | string |

### 🔌 API & integrations

Run this Actor from the Apify Console, API, CLI, MCP, Make, Zapier or n8n. Replace the Actor identifier and token in this template:

```bash
curl -X POST "https://api.apify.com/v2/acts/cisa-kev-remediation-radar/runs?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

Results are stored in the run's default dataset and can be forwarded with Apify webhooks or scheduled Tasks.

### 🔎 Search keywords

CISA KEV Remediation Deadline & EPSS Radar, cisa, kev, remediation, deadline, epss, radar, Apify Actor, scraper API, structured data, scheduled monitor, automation.

# Actor input Schema

## `dueWithinDays` (type: `integer`):

Rolling remediation window starting today. Use 0 to return only items due today or overdue.

## `includeOverdue` (type: `boolean`):

Include KEV entries whose CISA remediation deadline has already passed.

## `overdueWithinDays` (type: `integer`):

Limit overdue findings to deadlines missed within this many days, preventing years-old KEVs from overwhelming the queue.

## `addedWithinDays` (type: `integer`):

Optionally include only vulnerabilities added to KEV within this many days. Zero disables this filter.

## `vendors` (type: `array`):

Optional case-insensitive vendor filters, for example Microsoft, Cisco, or Fortinet.

## `products` (type: `array`):

Optional case-insensitive product filters.

## `keywords` (type: `array`):

Match any keyword across CVE ID, vendor, product, name, description, and required action.

## `ransomwareOnly` (type: `boolean`):

Return only vulnerabilities CISA associates with known ransomware campaigns.

## `minimumEpss` (type: `number`):

Minimum FIRST EPSS score from 0 to 1. Zero keeps entries without an EPSS score.

## `maxItems` (type: `integer`):

Maximum matching rows written and charged.

## Actor input object example

```json
{
  "dueWithinDays": 30,
  "includeOverdue": true,
  "overdueWithinDays": 30,
  "addedWithinDays": 0,
  "ransomwareOnly": false,
  "minimumEpss": 0,
  "maxItems": 100
}
```

# Actor output Schema

## `findings` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("snuggly_beanie_970/cisa-kev-remediation-radar").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("snuggly_beanie_970/cisa-kev-remediation-radar").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call snuggly_beanie_970/cisa-kev-remediation-radar --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,snuggly_beanie_970/cisa-kev-remediation-radar"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/bAAwvccznRX0gtpOL/builds/uIwvMGgMe76bg8AW5/openapi.json