CISA KEV Asset Remediation Report

Security and vulnerability-management teams provide a bounded asset inventory, the actor compares it with the official CISA Known Exploited Vulnerabilities Catalog, and the output is a source-linked review queue containing conservative potential matches, CISA required actions, due dates, deadline signals, and optional exports.

The first baseline_only run and every unchanged run produce zero rows and zero charge.

Every match is labeled potential_match and review_required. The actor never asserts that an asset is vulnerable, compromised, exploitable, compliant, or remediated.

Store Quickstart

1. Supply one or more assets that your team is authorized to review. Each asset needs vendor + product, or a CPE 2.3 value.
2. Run the first live check with initialRunMode: "baseline_only". It validates the complete CISA catalog, saves the snapshot, and emits 0 rows / 0 charge.
3. Reuse the same monitorKey for later checks. Use emit_backfill for the first comparison that should deliver changed matches.

The smallest useful trial is:

{
  "assets": [{ "assetId": "web-prod-01", "vendor": "Apache", "product": "Log4j2", "versions": ["2.14.1"] }],
  "monitorKey": "trial-kev-portfolio",
  "initialRunMode": "baseline_only",
  "generateReport": true,
  "emitPotentialMatches": true,
  "includeDeadlineAlerts": true,
  "deadlineWithinDays": 30,
  "emitUnchanged": false,
  "emitExport": false,
  "dryRun": false,
  "maxChargeUsd": 0
}

Example 1: production inventory

{
  "assets": [
    { "assetId": "web-prod-01", "vendor": "Apache", "product": "Log4j2", "versions": ["2.14.1"], "environment": "production" },
    { "assetId": "edge-01", "vendor": "Example Vendor", "product": "Example Appliance", "versions": ["4.2"] }
  ],
  "monitorKey": "production-kev-watch",
  "initialRunMode": "emit_backfill",
  "generateReport": true,
  "emitPotentialMatches": true,
  "includeDeadlineAlerts": true,
  "deadlineWithinDays": 45,
  "emitUnchanged": false,
  "emitExport": true,
  "dryRun": false,
  "maxChargeUsd": 30
}

Example 2: CPE-backed inventory

{
  "assets": [{
    "assetId": "linux-image-01",
    "cpe": "cpe:2.3:a:example:appliance:4.2:*:*:*:*:*:*:*",
    "product": "Example Appliance",
    "vendor": "Example",
    "versions": ["4.2"],
    "environment": "staging"
  }],
  "monitorKey": "staging-kev-watch",
  "initialRunMode": "baseline_only",
  "generateReport": true,
  "emitPotentialMatches": true,
  "includeDeadlineAlerts": true,
  "deadlineWithinDays": 14,
  "emitUnchanged": false,
  "emitExport": false,
  "dryRun": false,
  "maxChargeUsd": 0
}

Example 3: deterministic dry run

{
  "assets": [{ "assetId": "demo-01", "vendor": "Apache", "product": "Log4j2", "versions": ["2.14.1"] }],
  "monitorKey": "dry-run-demo",
  "initialRunMode": "emit_backfill",
  "generateReport": true,
  "emitPotentialMatches": true,
  "includeDeadlineAlerts": true,
  "deadlineWithinDays": 30,
  "emitUnchanged": false,
  "emitExport": true,
  "dryRun": true,
  "maxChargeUsd": 50
}

Dry-run output is deterministic and does not call the network, save state, or charge events.

Output

kev_remediation_report is emitted first. It summarizes changed potential matches. kev_asset_potential_match carries the asset join, CISA CVE, vendor/project, product, description, requiredAction, dueDate, source URL, and explicit review labels. kev_deadline_alert carries the due-date window or due-date change reason. kev_remediation_export lists the stable keys included in the handoff.

The CISA requiredAction and dueDate fields are copied as source evidence. versionMatchStatus is not_assessed_from_cisa_catalog; the CISA feed does not provide enough inventory mapping to prove version applicability.

Pricing and billing safety

Event	Price	When it is charged
kev-asset-potential-match	$0.06	A changed conservative potential match is delivered
kev-deadline-alert	$0.35	A changed/new match has a due-date review signal
kev-remediation-report	$12.00	A changed portfolio report is delivered
kev-remediation-export	$8.00	An export handoff is delivered

There is no start event. A baseline or unchanged run is always 0 rows and 0 charge. The complete unique event plan is checked against maxChargeUsd before the first push. Unknown event names, duplicate CVEs, invalid catalogs, state failures, missing charge proof, and budget overruns fail closed.

Compliance and interpretation guardrails

• Official source: CISA KEV JSON only. No API key is required.
• The buyer must supply an authorized, bounded inventory. The actor does not scan networks or discover assets.
• Every match means potential_match and review_required, never a confirmed finding.
• Do not use the output as a statement of vulnerability, compromise, exploitability, compliance, legal status, remediation completion, or security advice.
• Review the current official CISA record and internal evidence before assigning work.
• The actor is not affiliated with or endorsed by CISA or the U.S. government.

See also

For adjacent review workflows, compare this actor with the package portfolio upgrade report and product safety market-action portfolio report. They use similar baseline, change detection, report-first, and fail-closed delivery patterns for different source domains.

See docs/source-compliance.md, docs/integration-guide.md, and docs/sample-output.json for the operational contract.